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TECHNICAL PAPER 


THE ROLE OF FAILURE/PROBLEMS IN ENGINEERING: 

A COMMENTARY ON FAILURES EXPERIENCED— LESSONS LEARNED 

I. INTRODUCTION 


“Quality is our job one” is the phrase heard continuously. In a technological age, our 
lives are influenced strongly by quality or the lack thereof. Our personal lives are affected. 
Our professional lives are driven by its focus. We all are concerned with who our customer is 
and how we meet his or her requirements to build a better product. How do we meet the 
goals of total quality management (TQM)? is our pressing question. Many tools are in place 
undergirded with a management theory and a companion set of principles. Many other tools 
are being developed. However, if the goals are to be achieved, we must have knowledge and 
understanding. One way of achieving understanding and insight is through studying problems 
and failures. The study of problems, in the presence of appropriate theory, produces sets of 
principles important to achieving quality, first of all, and second, helps us focus our technology 
and better understand our expertise and the physics of the problem. This report deals with 
the principles derived and lessons learned from years of space flight engineering. A separate 
report, to be published later, is a compilation of synopses of the problems experienced. 

These reports are based on three perspectives: (1) 51-L space shuttle Challenger 
accident investigation, (2) safe return of the shuttle to flight activities and the continuing 
flights, and (3) 35 years of engineering experience. The general finding upon which the report 
is based is that “failure, problems, in general, were not due to undiscovered or missing 
theory; but to the neglect or oversight of basic principles” (fig. 1). These oversights are in 
management, criteria, procedures, philosophy, test, analysis, communication/documentation 
and project management areas of a program. 

This is not meant to down play technology — technology is foundational to our busi- 
ness and must be vigorously pursued. We get excited about technology, selling it well, and do 
an outstanding job in its development while other key ingredients appear to be mundane in 
comparison and therefore take the back seat. This should not be the case. 

The study and importance of failure in design evolution is well documented. 1 - 3 
Understanding prior failures provides the basis for technology development, better solutions, 
systems operation points near margins, and safety. All designs by definition are designed for 
failure. As the design evolves and changes, it forces changes in the requirements, thus, the 
performance changes. Reference 1 discusses these compromises of design. 

“The requirements for design conflict and cannot be reconciled. All designs for 
devices are in some degree failures, either because they flout one or another of 
the requirements or because they are compromises, and compromise implies a 
degree of failure. 

“Failure is inherent in all useful design not only because all requirements of 
economy derive from insatiable wishes, but more immediately because certain 
quite specific conflicts are inevitable once requirements for economy are 
admitted; and conflicts even among the requirements of use are not unknown. 



“It follows that all designs for use are arbitrary. The designer or his client has 
to choose to what degree and where there shall be failure. Thus the shape of all 
designed things is the product of arbitrary choice. If you vary the terms of your 
compromise — say more speed, more heat, less safety, more discomfort, lower 
first cost — then you vary the shape of the thing designed. It is quite impossible 
for any design to be ‘the logical outcome of the requirements’ simply because 
the requirements, being in conflict, their logical outcome is an impossibility.” 

This being the case, it is imperative that failures, as well as the problems experienced, 
be understood. As the Greeks say about the Phoenix bird, that out of the ashes of destruction 
rises newness. Problems and our reaction to them determine character and through this effort 
comes the greatest learning and achievement. As man has pushed technology to achieve the 
successes of space exploration, many problems have occurred, some resulting in major fail- 
ures, even national disasters. Disasters bring one to the ashes, both personally and collec- 
tively, both technically and economically. Out of these ashes must rise again the new 
Phoenix. There is a story that goes something like this: 

“A farmer and his wife had experienced a very good couple of years’ harvests. 

They were comfortable, with money in the bank. They discussed the situation, 
noticing their cattle and the rickety old barn. They decided to build a new 
modern barn, replacing the old one before winter. The bam was built with 
comfortable stalls, heat, and lighting. The bam was completed and the old barn 
demolished. They decided to go to town and celebrate. As they were returning 
home that night, the first winter storm came blowing in. They commented what 
great shape the cattle would be in. Arriving home, the farmer decided to go out 
and see how the cattle were doing in the new bam. Turning on the lights, not 
one of the cattle was to be seen. He panicked. Someone had stolen his cattle! 

He ran outside to look for evidence and noticed the cattle standing in the 
foundation marks of their old stalls.” 

As we at NASA dealt with the Challenger (SL-51) accident and the myriad problems 
that have occurred in the return to safe flight and ensuing flight program, the goal has been to 
birth a new Phoenix bird, to build a new barn that does not disregard the old foundation, but 
moves into the new. It is hoped that this report will help in that process by documenting a set 
of principles and a synopsis of problems and how they were solved. Interwoven with each is a 
personal testimonial and its resurrection which is probably the real story; however, that is left 
to others. As stated previously, this report documents a seminar given to several aerospace 
companies and three NASA Centers. It also augments two previous reports, TP2508 and 
TP2893, which contain some of the same information. In general this report serves as a gen- 
eral overview with supporting summary data to the other documents. It deals with problems 
covering all major applied mechanics disciplines and also contains a short discussion of the 
Challenger accident. 

In dealing with problems, one can get the idea that one is negative and pointing fingers 
or placing blame. That is not the case. All have performed exceptionally well, producing 
unprecedented machines. The purpose in enumerating problems is to learn lessons and 
produce better machines in the future. 

May this report add a small flicker of light on the path to the future of space. 


2 



II. BASIC PRINCIPLES 


As stated in the introduction, the study of problems has led to the conclusion that thq 
violation of basic principles, not missing technology, is the culprit. The solution of this prob- 
lem, of violation of basic principles, determines success. The Challenger accident, its results, 
and the attendant return to flight activities were the driving force behind a lessons-learned 
report published in January 1989. 4 This report was written as the result of numerous inquiries 
as to “What have you learned?” This paper expands the concepts to include the influence of 
constraints, schedules, etc., on the design. Saturn, Apollo, Hubble space telescope (HST), 
and the space shuttle are used to illustrate the concepts and the derived principles. In gen- 
eral, these observations deal with design and verification principles which, if practiced, should 
greatly reduce problem occurrence, the thrust of this paper as delineated in figures 1 through 
4. Two pivotal concepts are the keys to quality: (1) system focus is one of the foundations of 
high quality, and (2) the correlation of hardware sensitivity to the performance requirements. 
Twelve principles support these pivotal concepts. 

A. System Focus 


1. General 

What is meant by system focus? is one of the hardest questions to answer in 
engineering. Most look at some part of systems and call that the system focus; integration, 
etc. First and foremost, it is an attitude, as it is the foundation of TQM. Second, it is the tying 
together of large hardware, software, vehicle, facilities, and operational systems into a cohe- 
sive bond integrating all disciplines, hardware, software, etc. from determining requirements 
and performance to verified operational hardware. Third, it implies teamwork and open com- 
munications, which says that all involved must have some knowledge of each system outside 
one's own specialty and be willing to communicate and share (fig. 3). It also implies incor- 
porating manned rating, when applicable, up front in the design as well as failure mode and 
effects analysis (FMEA)/critical items lists (CIL’s) to identify and design out failures (fig. 
6). What is neglected in design due to a lack of system focus must be accounted for by good 
system optimization during operations. It is a pay me now or pay me later condition. This is a 
fundamental lesson learned from studying the system focus. 

Engineering is a process based on principles of technical disciplines, management, etc. 
Its application involves risks. Reduction of risks requires both knowledge of the process and 
the inherent subprocesses, the technical disciplines, and the ability to judge merits of each. 
The system focus is fundamental to lowering these risks through decision making involving 
the system from front to end, concept to operations, and considering total cost. Total cost is, 
in all probability, the hardest item to define, certainly it is the hardest to calculate. The great 
challenge is how one balances total cost with risks to arrive at an acceptable answer. 

Figures 7 and 8 are an attempt to show two approaches to the system focus. The first 
is the idea where one iterates using total cost as the criteria to determine drivers (sensitivity 
analysis), conducts concept testing, and arrives at robustness criteria that produces a basis 
for an optimized system. This must be accomplished in conjunction with the customer and his 
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needs. When one talks about total cost, it is all inclusive, including vehicle, facilities, opera- 
tions, software, hardware, manpower, transportation, manufacturing, design, and mainte- 
nance. Robustness says that the design is insensitive to variations, environments, manufac- 
turing, and other effecting parameters. Also that the design controls them and the margins. 
All are part of the optimization. To produce this optimized configuration, several iterations are 
required through the total loop (dotted line). 

Use of techniques of TQM to transfer the customer's requirements into quality sys- 
tems enhances this process. A more detailed look at this process is shown on figure 9. The 
first shows it for the major elements of design while the latter shows still more details. The 
resulting configuration that is selected and verified then has low operational cost, flexibility 
safety, and performance. As was stated in the introduction, however, design is a compromise 
which implies some degree of failure. Figure 8 attempts to capture this situation by changing 
the contents in the various blocks of the process. Notice that cost is constrained up front as is 
size, weight, etc., in an attempt to meet goals from outside, such as those imposed by 
Congress. This changes the other blocks limiting sensitivity analysis and concept testing. 

These are not new debates or ideas. References 5, 6, and 7 deal with discussions and 
debates centering around what has happened in various projects throughout space history, 
particularly starting with Apollo. Fundamental to this loop is the correct setting of 
requirements, particularly the derived requirements, which now must be set in terms of 
constraints; these constraints being in conflict with requirements, objectives, etc. This forces 
a compromise in the configuration, as is indicated on figure 8. The design is now a 
suboptimized configuration instead of an optimized one with robustness. Once given this 
constrained system, one must work within it to produce the best system from requirements to 
product using the best tools and skills. This interactive flow between the customer's desires, 
design, manufacturing constraints, cost functions, maintenance, and operations, etc., 
determines the design and performance. As illustrated in figure 8, the suboptimal approach 
produces a system that in the end does not totally meet the performance goals, is more costly 
to operate, and does not have flexibility. In later sections, several space systems will be 
evaluated in terms of this principle. 

In fact, what was not made robust must be covered in operations by system con- 
straints, stringent operational procedures to insure safety. The resulting problems and fail- 
ures take many forms, and the consequences are determined by when and how they happen. 
For example, proof testing is designed to screen defects; therefore, failure in proof can indi- 
cate the test has accomplished its objective or it can be a design deficiency. Repeated proof 
failures indicate either a design or manufacturing deficiency. Failures during development can 
be corrected, but are costly. Failures alluded to can also result in the excessive maintenance 
and refurbishment required for safety on limited lifetime parts. All these mean that 
FMEA/CILS's and hazards must be an up-front part of design to help reduce these impacts, 
design in redundancy, etc. The following table lists the categories of failures and problems 
one needs to understand. 
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Table 1. Classes of problems. 


L Major Failures 

a. Design Deficiencies 

b. Quality Control/Manufacturing 

n. Proof Test Failures 

HI. Localized Failures (Contained) 

IV. Hardware Limitations (Design Deficiencies) DAR’s 

a. Lifetime 

b. Performance Limits 

c. Redlines 

d. Inspections 

e. Refurbishments 

f. Special Analysis and Tests 

V. Hardware Limitations (Manufacturing, etc., Deficiencies) MRD’s 

a. Measurements 

b. Inspections 

c. Analysis and Test 

d. DAR’s 

Comparing the two system approaches means that up front much more analysis, test, 
etc., must be accomplished to determine drivers and to select optimized configurations. 
Obviously, this is another way of saying what is shown in many TQM courses with the qual- 
ity level (fig. 10). Notice the factors on quality payoff versus program phase compared to 
recognition. Does this not say that if one wants to advance professionally, he waits until pro- 
duction then puts on his thinking cap and solves problems. Somehow this must be turned 
around. This is said partly in jest, yet our rewards system greatly favors the Production 
Phase problem solving. A companion chart (fig. 11) shows the cost for the two approaches 
versus program phases. One can further conclude that most of the requirements become 
derived requirements because their origins lie in the conceptual, design, and development 
work as modified by imposed constraints. This is due to a general principle which states 
“What is done up front in a project — requirements, constraints, etc. — ^determines, to a large 
extent, the quality and performance of the design. What is done in production and operations 
tends to be fine tuning of this predetermined configuration and is very costly if robustness is 
not present.” Figure 6 summarizes this. “Pay me now or pay me later” certainly applies. 

Coupled strongly with the system focus is the principle that the higher the per- 
formance requirements, the greater the sensitivity of the system, subsystem, or part to 
variations in any parameter including manufacturing, environments, etc. This and the other 
ungirding principles to the system focus are discussed in later sections. 
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2. Project Examples 

Three programs of NASA (Saturn, space shuttle, and HST) illustrate how the system 
focus functions in real life. The following discussion of Saturn, Apollo, space shuttle, and the 
HST is not meant as criticism or that any other path was possible. In fact, it is very probable 
that no other option existed at the time; however, when that is the only course, it must be 
clearly understood from cause and effect on systems so that the best design possible is 
achieved. With the exception of Saturn, these systems have not always met their initial per- 
formance goals and were usually more costly than predicted; however, each has been out- 
standing performers, indicating excellent engineering and management regardless of the sit- 
uation imposed by economics, etc. 

a. Saturn/Apollo/Skylab 

The Saturn, Apollo, and Skylab vehicles were an evolutionary process that began with 
the development of the Saturn I vehicle built from the manufacturing propulsion technologies 
of the Redstone and Jupiter systems. Tanks, using Redstone manufacturing, clustered around 
a center tank using Jupiter diameters and manufacturing were used with a spider beam at the 
top and a thrust frame at the bottom containing a cluster of eight H-l engines forming the first 
stage. The second stage was designated the S-IV. This vehicle, which became the forerunner 
of the Saturn IB, evolved through two block changes during 10 successful flights. The block I 
had no aerodynamic fins on the vehicle, and the second stage was not live. Block II had aero- 
dynamic fins and a live S-IV stage using a cluster of Pratt and Whitney RL-10 engines with 
uprated H-l engines on the first stage. The propellant tanks were also lengthened. The 
instrument unit became a prototype for the Saturn IB and Saturn V. 

The Saturn IB represented major advancements for the hardware and techniques for 
the lunar missions and was the vehicle for launching men for the various Skylab missions. 
The vehicle's first stage had a more efficient, lighter weight structure (performance enhance- 
ment) as well as further uprating of the H-l engine. The S-IV stage was powered by a new, 
single-stage liquid hydrogen J-2 engine (also used in Saturn V). The vehicle was the 
workhorse to wring out the Apollo command module and lunar module in the manned mission 
scheduled to be launched on the 51B 204 vehicle. This mission was delayed 1 year to solve 
problems associated with the Apollo capsule fire. The Saturn IB afforded the opportunity to 
flight-test important elements of Apollo-Saturn flight hardware as well as operational proce- 
dures, etc. It also powered the first manned Apollo mission, Apollo 7, clearing an important 
hurdle for Apollo. Figure 12 is a schematic of the Saturn IB vehicle, while figure 13 gives its 
basic characteristics and performance requirements. After the successful Apollo program, it 
became the vehicle for launching astronauts to the orbiting Skylab program, completing four 
successful missions. This evolutionary development program has much to do with the 
successes of Apollo followed by Skylab, and illustrates much of the system focus being dis- 
cussed. 

The Saturn V vehicle was used to launch both the Apollo lunar missions and the 
Skylab mission. Figure 14 shows the Saturn V, while figure 15 compares the Apollo configu- 
rations and the Skylab vehicles. 

The vehicle was a three-stage, in-line vehicle composed of the S-1C first stage using 
a cluster of five F-l engines burning RP1 developing 1.5 M lb thrust each. The second stage, 
S-II, was composed of a cluster of five J-l engines burning liquid hydrogen, developing 
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approximately 230,000 lb of thrust each. The third stage, S-IVB, had a single J-2 engine 
burning liquid hydrogen, developing approximately 200,000 lb thrust. For the Apollo mission, 
the service module had a single engine for midcourse corrections, lunar orbit escape, etc., and 
was separated from the command module before Earth atmosphere reentry. Figures 16 and 
20 show the basic characteristics by stages. The Skylab version replaced the S-IVB stage 
with the Skylab space station and eliminated the command and service module being an 
unmanned vehicle. 

Saturn/ Apollo is a mixed bag in terms of total optimization. It, in fact, was not a total 
optimized system. It did however, have robustness from most viewpoints. Several books 
have been written, covering these design and program evolutions from all aspects — political, 
manned operations, design, etc. 5-10 Early on, a lot of analysis and testing was accomplished 
which had strong impacts on the success of the program. The program also had problems late 
that had to be resolved in a brush fire mode; hydrogen engine combustion instability and the 
Apollo capsule fire, for example. These are probably typical of what could be expected in a 
system pushing state-of-the-art technology. Many would argue that at least the capsule fire 
was preventable, which is always the case if one had the knowledge prior to the accident or 
problem that is known afterward. Interestingly, the focusing that occurs when solving prob- 
lems sharpens and marshals the brain, which intensifies efforts leading to insight and con- 
cepts that are not there in potential problem analysis modes. The Saturn Apollo was, how- 
ever, robust in most respects. 

Robustness is illustrated in terms of structural capability which allowed the Skylab 
mission. Figures 21 and 22 show the aerodynamic pressure distribution for Apollo and Skylab 
configurations. The Skylab had a forward peaked aero distribution which peaked the bending 
moment in the S-VB stage versus the Apollo version which was more averaged (fig. 21 and 
22). This resulted in a more in-depth wind biasing and probabilistic (Monte Carlo) assess- 
ment using the measure Jimsphere wind ensembles. Figure 23 and 24 show the bending 
moment probability for nonwind biasing and wind biasing versus bending moment capability. 
By using wind biasing, the vehicle could be brought into an acceptable loads response level. 
This was further insured on the day of launch using conditional probability in conjunction with 
measured wind data for launch constraints, that precluded launching into an unsafe winds 
aloft condition. 

The ability to incorporate five engines on S-IC and S-II stages, although not optimum, 
further illustrates robustness in both the structural and propulsion systems. As a result, per- 
formance flexibility made possible the lunar rover mission, and very likely the lunar orbit ren- 
dezvous mode option that was made late in the program. 5 

The use of the Saturn I, basically as a development vehicle, and IB, as not only a 
workhorse but as a test bed for Saturn V, was clearly a desired evolutionary approach. 
Funds, etc., preclude this in many cases and, therefore, the development risks must be 
reduced in other ways. 

b. Hubble Space Telescope 

The HST is the world’s greatest orbiting observatory. Its accuracy and precision are 
unprecedented. The pointing accuracy is 0.007 arcsec, which is equivalent to focusing on a 
dime from Washington to Boston. The HST (fig. 25) is composed of the outer protective shell 
(called the SSM), the momentum wheels that control the vehicle by varying each wheel's 
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speed, and the aperture door for blocking direct sunlight from the instruments allowing more 
science time. The inner parts are the heart of the optical telescope assembly (OTA) system 
composed of the metering truss mounting, the primary and secondary mirrors, the focal plane 
structure, and the aft truss mounting the scientific instrument. To eliminate thermal distortion, 
the frames are made of composites with near zero Ct (coefficient of thermal expansion). The 
mirrors must be accurately located relative to each other (fig. 26). The light enters striking 
the primary mirror, which focuses it on the secondary mirror. The secondary mirror focuses 
the light back through a hole in the center of the primary mirror onto the scientific instruments. 
The instruments are: (1) the fine guidance sensor, (2) the faint object spectrograph, (3) the 
wide field planetary camera, (4) the photometer, (5) the high resolution spectrograph, and (6) 
the faint object camera. They function to perform the fine pointing and to gather various 
scientific data from studying the heavens (fig. 27). 11 Power is provided by solar arrays in 
conjunction with storage batteries. The control system uses six rate gyros and the two fine 
guidance optical sensors to provide roll, pitch, and yaw information, and is designed to keep 
the observatory accurately locked to within 0.007 arcsec on a subject for extended periods. 
This is equivalent to 1.2-cm offset at a distance of 600 mi (1,000 km). Temperatures within 
the telescope are controlled actively and passively to assure pointing accuracy and structural 
stability. 

Not only is the spacecraft itself very complicated, but so is the management and 
organization. The scientists gather the data and analyze it while NASA operates the craft. 
The scientists work through the space institute, NASA/Marshall Space Flight Center 
(MSFC) was responsible for design and deployment, and NASA/Goddard Space Flight 
Center (GSFC) was responsible for the scientific instruments and operations. It was a major 
effort to balance between the scientists’ desires and the engineering 
project constraints during design. 

The space telescope was fraught with problems early in the program. Budget con- 
straints, etc., kept changing the requirements and design. Reference 11 is an excellent disclo- 
sure of the telescope design, management, and other problems as the project evolved. 

Early in the program, as a cost saving, it was decided that the project office would be 
the integrator and that, due to the proprietary nature of some of the hardware, all data would 
exist only at two or three co-located rooms. Engineers would have to go to those rooms for 
information. A tight development cost constraint was also imposed. Military constraints due 
to their heavy defense involvement at Perkin Elmer early in the program further constrained 
activities. The end result was a lack of systems focus. Many other earlier decisions and con- 
straints helped shape the HST and influenced adopting the associate contractor approach. 11 
As the program progressed major problems resulted, creating large cost overruns. As a 
result, the project had to retreat and form system teams and panels such as control, 
dynamics, etc., composed of the members from MSFC, GSFC, Lockheed, Perkin Elmer, etc., 
to solve the problems. In addition, an MSFC project and engineering team was dedicated to 
insuring a good system co-located at Lockheed and Perkin Elmer. The team was active for at 
least 1 year. The end result was a good, verified system, but with a large cost overrun. Some 
of the problems have been discussed in reference 4, the others appear later in this document, 
some others were not related to the technical disciplines discussed in this document. Maybe 
this says that the time to put teams in place at the contractors is early in the program to fully 
ring out requirements and design issues, eliminating downstream problems instead of waiting 
until after the problems occur. The problem found in flight of the mirror spherical aberration 
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has been left to the special investigation team; otherwise the HST has performed in an excel- 
lent manner for such a complex machine. 

c. Space Shuttle 

The space shuttle vehicle is composed of an expendable external propulsion tank 
(liquid oxygen and hydrogen), a reusable orbiter with liquid main propulsion engines (space 
shuttle main engines — SSME’s), the orbiter maneuvering system (OMS), two solid rocket 
boosters (SRB’s) (partially reusable), and the various payloads (fig. 28). The payload maxi- 
mum size is 15 by 60 ft. The maximum weight depends on the desired orbit. The orbiter has a 
stay time on-orbit up to 2 weeks with a crew of up to five. The total weight is approximately 
4.5x1 0 6 lb as shown on the schematic in figure 29. MSFC has the responsibility for the 
development and operation of the external tank (ET), the solid rocket motor (SRM) and 
booster, and the main engines. Various Centers have responsibility for different payloads. 
MSFC is responsible for the HST, the Spacelab system, etc. Johnson Space Center (JSC) and 
Rockwell Space Division are responsible for the orbiter and total vehicle integration. 

(1) Characteristics : A typical shuttle mission is shown on figures 30a, b, and c. The 
mission starts with the vehicle and payload assembly, then moves to the launch pad via the 
mobile launch platform (MLP). The vehicle sits on the pad unfueled until about 10 h prior to 
launch, at which time it is fueled. Due to the cryo propellant temperatures, the vehicle 
shrinks. The aft SRB-to-ET struts are designed to account for this shrinkage. The weight of 
the propellant further loads the vehicle-to-MLP interfaces and the element-to-element inter- 
faces. This causes the vehicle SRM's to bow laterally and the total vehicle to bend in the 
pitch plane. The cryo shrinkage moves the struts 7°, putting them perpendicular to the SRB 
and ET (designed to account for the movement). This causes a punch load toward the tank 
which is counteracted by the radial shrinkage of the tank. This stores energy in the structure 
to be released at lift-off (fig. 31 and 32). The SSME's are ignited and must be at 90-percent 
power level before igniting the SRM’s, which store even more energy in the structure. 

In order to reduce these lift-off loads, a trade study of performance versus loads was 
made on delaying the SRB ignition until a minimum stored energy point is reached. The 
results of this trade came out in favor of the delayed SRM ignition. The dynamics are that the 
SSME thrust (force) bends the vehicle and lifts it due to engine cants and asymmetries 
pushing the orbiter and tank between the SRB’s in a gear train mode (fig. 32), setting up an 
oscillation which produces minimum stored energy approximately 6 s after SSME ignition, at 
which time the SRM’s are ignited (fig. 33). The SRB’s obtain above 900 psi internal pressure 
stretching the vehicle in a longitudinal transient mode simultaneously with the release of the 
stored potential energy. The holddown bolts are blown and the aft skirts released from the 
pad. Large vehicle dynamic motions result. 

Figures 34a and b show a time trace of a strut load during these events. As the 
vehicle clears the tower, it is rolled up to 180° (mission dependent) to put the orbiter down, 
which produces a more optimal total thrust angle. At 20-s flight time, the vehicle performance 
is assessed (velocity). If performance is low, the main engines are not throttled as deeply 
(adaptive guidance) as planned to make up the performance. If the performance is nominal, 
preprogrammed throttling occurs. If performance is high, deeper throttling occurs if possible 
(engines can only throttle to 65 percent). Engines are throttled to keep the dynamic pressure 
within design limits as the vehicle traverses through the maximum dynamic pressure regime. 
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also, during the time of high winds. Pitch, yaw, and elevon load relief are used to reduce aero- 
dynamic loads at the expense of performance. This also introduces high thermal loads after 
max q when the vehicle is moving back to its optimum path (large side-slip angles intro- 
duced). 

4 

The events just discussed represent some of the major trades made during the shuttle 
design phases. Loads versus performance losses being the key. The option was to beef up 
the structure to handle loads (performance loss) or deviate time and trajectory path and 
reduce loads (performance loss and loss of launch probability). The trade, in general, came 
out to take the deviations and not beef up the structure. In some specific cases structure was 
beefed up. Meeting requirements is always a trade and never comes for free. 

The next event is SRB separation. This is a dynamic event triggered when the SRM 
thrust drops below a certain level. The event is dynamic with firing of pyrotechnics to sepa- 
rate the interfaces and separation motors to move the SRB’s away from the tank/orbiter. Two 
parallel events follow. The orbiter/ET continues to thrust to gain orbit while the SRB’s 
reenter the atmosphere, opening the parachute in stages to reduce loads, then water impact 
creating large loads. After being towed back to Kennedy Space Center (KSC), the SRB’s are 
refurbished for reuse. The orbiter/tanks next main event is the tank separation and disposal 
(breaks up on reentering the atmosphere). The resulting debris footprint is critical and must 
be controlled. The orbiter then fires its OMS engines to achieve the final desired orbit. After 
completing its mission, the orbiter reenters by firing the OMS engines, slowing the vehicle, 
then it reenters the atmosphere and lands. All of these are very fine-tuned and critical 
events. The reentry drives the thermal protection system design which is very critical to sur- 
vival. The on-orbit phase is unique for each mission. One additional complication occurs dur- 
ing the ascent phase — abort options (fig. 35). Early in the mission engine failures mean 
ditching. Next comes return to launch site (RTLS), a very critical maneuver. Later in time the 
vehicle can abort to alternate launch sites, then comes abort to orbit (once around in a 
degraded orbit). Then finally, the desired mission orbit is achieved by firing the OMS engines. 

A complex launch constraint system is in place to ensure that the vehicle is not 
launched in unsafe conditions. Part of this program involves taking winds aloft wind samples 
and calculating structural loads and performance margins. Approximately 2 h prior to launch, a 
choice is made between several I-loads (trajectory shape to reduce loads and increase per- 
formance margins). At 30 min, a decision is made relative to launch whether to launch or not 
based on this data. In the last part of the sequence prior to launch, all systems are monitored. 
A launch can be stopped if any system is out of specification. Most of these redline cutoffs are 
automatic. 

(2) Design Evolution : The questions that must be addressed are how did the shuttle 
evolve? and what major decisions shaped it into one of the world's most impressive systems? 
It is very complex, in most respects, being resuable, operating during launch, on orbit, reentry, 
and landing. Blending all these requirements into one machine was a great challenge. Initially 
(phases A and B), extensive sensitivity analyses were accomplished in several areas: 
propulsion systems (high performance engines), reentry heat protection, and applied 
mechanics. These early trades and sensitivity studies were accomplished to focus require- 
ments and design. The key sensitivities identified have guided not only the design, but the 
guide flight operations. Figure 36 shows the key system issues identified which includes tra- 
jectory (performance), loads, and control coupling, as well as control concepts and control 
authority issues. Figure 37 illustrates this performance control coupling showing the high 
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sensitivity of performance to the control concept chosen, as well as the trajectory shaping 
philosophy. Figure 38 illustrates the increased dynamic complexity over the Saturn V vehicle. 

With the advent of the parallel bum solid configuration, the complexity increases fur- 
ther, requiring 200 to 300 modes to represent the vehicle and payload combination at pre-lift- 
off and lift-off. Figure 39 illustrates the problems associated with lift-off and the unsymmetri- 
cal configuration, while figure 40 shows how this unsymmetry couples up the POGO oscilla- 
tion (longitudinal vehicle oscillation with the analogy of the pogo stick providing the name). 
As shown in the chart, this coupling was experienced on Saturn Apollo with only a small 
unsymmetry in the lunar excursion model (LEM) illustrating the power of dynamic coupling. 

The evolution of the space shuttle is shown in figures 41a, b, and c. Initially, the 
shuttle was totally reusable with a flyback booster. The engines were liquid using the same 
powerhead, but optimized nozzles for the booster and orbiter stages. The cost was estimated 
to be $14 billion for design, development, test, and engineering (DDT&E), based on 
estimated weight. The orbiter had ferrying capability and met all cross-range requirements. 
The payload size was constrained to the Air Force requirements of 15 by 60 ft. Due to 
national priorities, the funding was cut. An exercise was conducted during phase B to change 
the configuration to one that had parallel burn between the boosters and the orbiter stage. 
The booster options were liquids or solids. Finally, the cost (DDT&E) was frozen at the $5.5 
billion level and the solid booster configuration was selected. This meant that the engine 
nozzle could no longer be optimum since it had to start and operate in atmosphere and then 
operate in vacuum. This led to a requirement for the 470,000-lb vac thrust with an Isp of 
453 s. The orbiter self-contained ferrying requirement was eliminated, driving the system to 
the Boeing 747 ferry mode, the cross-range requirement from the Air Force remained, leading 
to the modified delta wing. Passive tiles for reentry thermal protection were chosen. 

The next step, in conjunction with the dollar constraint, was to place weight con- 
straints on the total system gross lift-off weight (GLOW) and each of the main vehicle ele- 
ments. This drove volumetric constraints along with the payload volume of 15 by 60 ft. As 
the vehicle evolved, the orbiter had problems meeting its constraint. The passive tile selec- 
tion possibly had some weight impact also, the silicon-based tiles are very sensitive to 
impact damage. This fosters a very elaborate program to eliminate ice and debris that could 
impact tiles and lead to a safety problem. Damage occurs on every flight but none to a safety 
concern. Damaged tiles had to be replaced. Each tile is hand fitted and installed. It is a well- 
known fact that the orbiter brake design was marginal prior to Challenger. This was fixed 
while the program was down during redesign of the SRM’s. 

Constraints/requirements drove several things. First, the SSME had been configured 
to throttle from 50 to 109 percent of rated power level (RPL) with all above 100 percent being 
used for abort purposes. The system changed the engine design requirements to operate at 
109 percent to increase performance and throttle to only 65 percent for dynamic pressure and 
acceleration control. The original SSME design was for a 100-mission lifetime. It was decided 
that by reducing the requirements to 55 missions, the lifetime of the engine could be met with 
the same basic design as for the 100 percent. This assumption did not hold up. Second, each 
element was asked to do a weight reduction program to make up the performance. This task 
was accomplished by all elements taking out margins. The ET accomplished part of this task 
by reducing the safety factor on all well-known loads from 1.4 to 1.25 since the tank was now 
expendable. Third, the performance of the SRM was increased to up performance, and the 
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thrust profile shape was modified to meet q constraints. The dynamic pressure “q” on the 
orbiter wing and tail during ascent greatly complicates the system. The large aerodynamic 
surfaces create large structural loads and trajectory deviations (drift). Vehicle control, per- 
formance, and loads are further complicated by the unsymmetrical configuration, both 
dynamically and statically. The maximum coupling (dynamic pressure) occurs at the altitude 
of peak winds. Figure 42 shows these major events and the phasing required to achieve 
successful flights in terms of loads, control, thermal, and performance. 

The original SRB’s had no control capability. Early in the design phase it became clear 
that the shuttle system was uncontrollable without control authority on the SRB’s. As a 
result, the SRM nozzle flex bearing, composed of layers of metal and elastomer, was 
designed and baselined. Actuators designed for the orbiter were used as actuation authority. 
This increased weight, complexity, and cost. In addition, two factors were used very early in 
phase C to take out conservatism, save weight and cost, and improve performance: (1) 
monthly mean wind biasing was instituted early in phase C as part of criteria change for gen- 
erating environments and performance, etc. (past programs had held that as a margin for 
operation and launch probability increases); and (2) prior programs used the 95-percent wind 
speed in conjunction with 99 percent wind shear and 99-percent gust as a conditional prob- 
ability approach. The space shuttle used 95-percent wind speed in combination with one half 
the shear and gust 99-percent levels, then root sum squaring the other half with the other 
parameters, again reducing margins. These two conservatisms are not wrong within them- 
selves since it could be shown statistically that these were safe approaches. What it did do 
was take out margins for flexibility, operations, and missed effects. No one, for example, 
expected the wing aero distribution to be missed significantly. Due to these constraints the 
above response and certain anomalies such as the aerodynamic pressure distribution on the 
orbiter wing, the space shuttle is very costly operationally. 

Each mission has to be specially shaped. To fly safely a performance loss near 4,000 
lb is incurred. In addition, a very elaborate wind monitoring, day of launch performance, load 
activity, and day of launch I load update is mandatory to ensure safety. It is very costly. The 
vehicle, in winter months only, has a 65-percent launch probability. To date three launches 
have been scrubbed for high winds. The SRB aft skirt has low margins and ground wind 
constraints. The SSME, although a very high performance machine, is very costly to insure 
safety through part changeout, limited lifetime, and hardware rejection. It is also restricted to 
104-percent power except for abort. As shown on the chart, massive redesign has taken 
place, orbiter landing gear, SSME two-duct hot gas manifold, weld elimination, pump 
changes, nozzle steerhorn, redesigned solid rocket motor (RSRM) aft skirt, etc. The 
advanced solid rocket motor (ASRM) is under consideration or in progress with approxi- 
mately 12,000 lb performance improvements, alternate high pressure turbopumps, large throat 
main combustion chamber (MCC), MCC casting, and weld eliminations. Orbiter tile damage 
and refurbishment are continuing costs. This discussion has shown how the constraints, in 
conjunction with requirements led to a high performance but costly operational system, which 
demonstrated the correlation between high performance and cost. 

The discussion that follows addresses several of the specific shuttle problems, as well 
as presents a brief look at the Challenger accident cause. 

(3) MLP/SRB Aft Skirt/Puck Rotation : Reference 4 addressed very briefly the failure 
of the SRB aft skirt during filament wound case verification testing and STS-26 reverification 
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testing. Two failures occurred at the same location. The failure was the result of not under- 
standing the sensitivity of the stress in the forging (holddown post) to skirt skin weld to 
radial loads. Figure 43 shows this sensitivity which was found in a posttest correlation 
analysis. The total skirt load, mainly compression on one side and tension on the other, was 
well understood. This load was critical to the holddown post and was studied extensively 
both for the eastern and western test ranges (different launch pad designs). What was 
missed was the radial load sensitivity which is a function of pad stiffness, etc., and was found 
in designing and analyzing loads for the western test range launch pad. As a result, new 
loads were generated. Although the total load was basically the same, the radial load 
changed which resulted in the failure of the filament wound case test skirt. New loads were 
generated for the eastern test range producing different radial loads. This effect can be seen 
on figure 44 where the radial load pushes the post outward bending the skirt at the weld, thus 
producing very large local stresses at the weld outer surface. This is a combined bend- 
ing/shear load. Figures 45 and 46 show the stress distribution on the surface and through the 
thickness. Notice the local nature both through the skin and surface wise. A special failure 
team was formed to investigate the failure cause. Special consultants were used to evaluate 
the NASA/USBI team. It was found that the problem was very nonlinear. No finite element 
model, in conjunction with extensive material testing, adequately predicted the failure. 
Nonlinear, theoretical, and simplified analysis 12 13 have indicated an explanation. What did all 
this mean? The skirt failed at a safety factor around 1.3 with a design/operational requirement 
of 1.4. Flight, therefore, must be on the basis of a waiver, or stop the program and redesign. 

Flying with a waiver as chosen in conjunction with several activities: 

a. Very extensive testing of the MLP to accurately define a new model for loads 
calculation. 

b. Loads were recalculated using this refined model. 

c. Strain gauges are grouped in the failure area to correlate loads predictions — this 
was used for STS-26 flight readiness firing (FRF) and all subsequent flights — showing the 
safety factor was not deteriorated with the stack. All flights showed the same general 
results. 

d. These same strain gauges are used to correlate analysis during stacking of the 
SRB and vehicle. Safety factors are calculated for each flight based on this data, and some 
improvement in margins has occurred. 

e. The puck on the post can be rotated biasing the skirt, producing larger margins; this 
has been demonstrated and used in flight. Special tests are underway to determine the 
sensitivity and limits of this biasing. It may be possible to get the safety factor back to 1.4 in 
this manner. 

f. Design analysis and test are progressing to define an alternate configuration which 
will restore margins, etc. 

The message is clear. Sensitivities must be understood and used to define all 
environments (loads in this case) or costly operational procedures, and analysis must be 
performed on a flight-by-flight basis. 
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(4) Debris Damage to Orbiter Heat Protection Tile : The reentry heat protection tiles 
have suffered damage on each flight. The major damage has occurred both at lift-off or ascent 
and orbiter landing. The landing damage is only a refurbishment/cost issue while the ascent 
damage can become a safety issue. Major emphasis has been placed on these events to 
eliminate debris sources. Some of the potential debris sources are (1) ET insulation, (2) ice 
buildup on the ET, (3) SRB nose cone insulation, and (4) pad debris blown up by SRB, thrust, 
etc. Extensive effort has been made to insure that insulation does not come loose. Included 
are bonding changes, insulation changes, pull test and repairs, pad cleanup prior to launch, 
etc. Prior to each flight, an ice team inspects to see if dangerous ice has been formed by the 
cryogenic propellants. A team inspects and maps each orbiter after landing to help determine 
sources. Special cameras are employed on some flights for the same reason. Clearly, the 
orbiter passive thermal tiles do an outstanding job; however, special care is required through 
the total system to insure safety of flight. System analysis and requirements must be under 
constant review with all changes evaluated against these considerations. 

(5) 51-L (C/?q//gnger) Accident : Before discussing the accident itself, it seems 
prudent to discuss some philosophy and approaches for design and failure investigations. It is 
a basic philosophy that all systems be modeled, analyzed, and tested to get data, then test 
verified, plus hot-fire and flight instrumentation for insurance and final verification. The space 
shuttle followed this philosophy using numerous avionics, dynamic, structure, wind tunnel, 
etc., tests, including the ALT program (orbit drop test). To verify the system, the first six 
flights were designated as development flights. Special instrumentation flew on these flights 
to gather information and verify the system. Several flights after the Challenger accident also 
flew special instrumentation. The design of a vehicle dictates that every event, from trans- 
portation through each flight phase, be fully analyzed and sensitivity studies conducted with 
key design data by event for each element, part, etc., developed. In general, during design 
and/or failure investigations, all events are analyzed to determine the key event for that part. 
The data that are presented then become the design data for that part, for that design event, 
and not the total vehicle or for other events. For example; the bending moment and shear for 
each SRR/SRM station is for the worse case event for that element and that station or part. 
The Challenger investigation followed that procedure in that most of the data are for the failed 
SRB, its failed joint, and its corresponding ET to SRB struts loads, although all the data for 
all events were analyzed. 

The Challenger accident was the major disaster of the space shuttle program. Lives 
were lost, a vehicle was lost, and the space program was shut down for several years, 
greatly hampering military operations as well as science and engineering research. The dis- 
cussion that follows could be under SRM; however, the final result was a total system f ail ure. 
No attempt is made to alter the Presidential Commission report, which is the basic reference 
document, but rather to provide a synopsis on the effort and the technical results. It is a part 
of this report due to its importance and impact to the space program. 

The primary failure was the SRM o-ring leaking the internal hot combustion gas to the 
outside through the first field joint in the direction of the SRB/ET attach point on the ET. All 
subsequent events and failures, including loss of the vehicle, were the result of this leak. 
Many other theories were advanced to explain the leak and/or the vehicle failure other than 
that concluded by the Commission; however, all were studied and ruled out by the 
Commission. These potential causes included (1) extremely high lift-off loads, (2) excessive 
winds aloft, (3) inappropriate assembly, etc. The breakdown in the system, whether NASA 
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management. Congress, etc., that led to a faulty o-ring system is not discussed, only the 
technical cause and effect of the design on the failure. First, the o-ring field joint 
characteristics, including failure, are addressed followed by a discussion of why the other 
causes could, with high probability, be ruled out. 

The field joint o-ring configuration is basic in concept but complex in characteristics . t 
Figure 47 shows the field joint o-ring as part of the two aft SRM segments and as a cross 
section of the two mating areas, the tongue and clevis. At ignition, the SRM becomes a pres- 
sure vessel due to the expanding burning propellants, reaching over 900 psi in around 600 ms. 
This large pressure has two effects: (1) the SRB case expands longitudinally, and (2) the 
case expands radially from the large pressure induced hoop stress. Due to the tang clevis 
configuration and the fasteners (pins) which lock the two segments together, these two 
effects cause a rotation between the tang and clevis at the o-ring location opening up the joint 
o-ring area. 

Initially, this phenomenon is transient in nature with the gap opening going from neu- 
tral to near maximum in 600 ms as the pressure rises. The gap opening then basically tracks 
the SRM internal pressure. Primarily the o-ring resiliency should energize the o-ring (initially 
compress at the neutral position) and track the opening gap. Secondly, under most conditions, 
the SRM pressure will further pressure actuate the o-ring providing a seal between the two 
surfaces. If the seal does not actuate, then hot gas under high pressure escapes to the out- 
side, destroying the seal. Other influences on the gap opening are the structural dynamic case 
response to vehicle dynamics and SRB-to-ET strut loads. Detailed finite element analyses 
correlated by test data were conducted in conjunction with lift-off and ascent response and 
loads analyses to determine the gap opening and the seal ability to track this opening. The 
lift-off and ascent analyses were a total dynamic shuttle systems simulation using several 
hundred dynamic modes and 3-sigma combinations of all environments. 

Figure 48 shows the resulting total gap opening during the time span of SSME igni- 
tion, SSME thrust buildup (first 6 and one-half s), SRM ignition (600 ms), and lift-off 
dynamics (approximately 3 s). Two extreme conditions are shown: (1) where the tang and 
clevis are initially metal-to-metal, zero gap time zero, and (2) maximum allowed clearance is 
present (20 to 25 mils gap, zero time). Notice that at maximum SSME thrust-induced bend- 
ing moment the gap opening delta is around 2 mils. At SRM ignition, 6.6 s, the gap opening 
delta diverges very fast. At maximum lift-off dynamics, there is superimposed on the pres- 
sure gap opening a dynamic effect from strut loads and bending (around 2 Hz). The split of the 
gap opening causes are: 85 percent due to pressure, 7 percent due to strut loads, 7 percent 
due to bending, and 1 percent due to shear. These effects are based on 3-sigma design loads. 
The o-ring clearly could not track the gap opening with a cold o-ring, as was the case on 
51-L, without pressure assist. Scale-model and full-scale tests, in conjunction with detailed 
instrumentation, have verified these effects on gap opening and o-ring resiliency (ability to 
track) as a function of temperature. One additional effect can keep the o-ring from tracking. If 
the clevis tang is near metal-to-metal in conjunction with o-ring and groove tolerances that 
cause the o-ring to totally fill the groove, then the pressure cannot actuate the seal, but 
instead will hold it in the groove (figs. 49 and 50). This was a strong potential for the failed 
joint based on tolerance data stacking data. Scale-model and full-scale test, in conjunction 
with detailed instrumentation, have verified these effects on gap opening and the o-ring 
resiliency (ability to track) as a function of temperature. 
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The above scenario explains the leaks (puffs of smoke) coming out of the aft field joint 
during lift-off. Why it sealed until max q is not well understood. Scale model tests showed 
leaks that sealed, probably with residuals from burning propellant, then reopened later. Also, 
why the joint (leak) reopened cannot be proven. As is shown in figure 51, the joint opens to 
its maximum early in flight, then closes down to about 80 percent of this maximum during max 
q due to reduced thrust and internal pressure that was implemented early in design to, control 
maximum dynamic pressure. Around 60 s the SRM pressure and thrust start rising again, 
opening the gap further. Residuals plugging the hole could have been crushed during this gap 
closing and become susceptible to dynamic effects (wind gust), combustion noise, or the 
slowly increasing internal pressure-induced gap opening. Internal SRM pressure, vehicle 
state (aero changes from leak plume, etc.) movies show the leak reopened at this time, con- 
tinuously increasing in size until the vehicle failed. The internal pressure loss corresponds to 
the increasing plume (leak) observed. 

The obvious question follows: How can the other proposed causes such as excessive 
loads, particularly from the strut, be ruled out? To answer the question it is best to split it into 
two parts: (1) pre-lift-off through the lift-off transient, and (2) post-lift-off transient through 
maximum dynamic pressure. 

(a) Pre-Lift-off Through Lift-off Transient: This event starts with vehicle stacking, 
transportation to the pad, fueling, start, and lift-off. The vehicle weight by elements is known. 
The mating is accurately controlled. The SRB's are shimmed to get uniform post loads and 
alignment. All these data are checked and recorded. Propellant loading is accurately moni- 
tored. Much data are recorded from strain gauges on the MLP side of the SRB holddown 
posts (milk stool), including camera coverage from several angles, showing SSME and SRB 
thrusts, temperatures, wind speeds, control data including rates, accelerations, actuators, and 
vehicle (SRB and ET) nose tip excursions, etc. The amount of energy stored in the vehicle 
from (a) weight, (b) cryo shrinkage, (c) winds, (d) thrust, etc., is well-known. Events timing 
is accurate. Using these data, loads, etc., can accurately be reconstructed. Figure 52a shows 
the vehicle on the pad showing peak load and bending moment for one SRB. This bending 
moment is the peak bending moment, commonly called quasi-static or static equivalent, 
determined using a detailed dynamic transient simulation (300 dynamic modes). This 
eliminates the need to calculate a static load, then put the conservative factor at 2 to cover 
dynamic effects. This later simplified approach is only recommended for simple systems. In 
complex systems like the shuttle it is a requirement that an all-up transient analysis be 
accomplished, eliminating the need for the approximate approach. Figure 52b shows a time 
trace through lift-off of bending moment and axial load. How can we know that? Six out of the 
first seven flights and all flights since Challenger (51-L) have skirt, strut, etc., loads 
accurately measured with strain gauge and accelerometers. Using the data mentioned above, 
the load events were reconstructed and correlated to the measure data (figs. 53 through 57). 
Accuracy has been very good. In addition, the design loads, particularly for the SRB, were 
generated for SRB ignition with maximum base bending moment instead of the near nominal 
measured on all flights. It also precluded a pad abort with the loads cycle repeated several 
times. Also, the dynamic model for loads was verified in a full-scale mated-vehicle test. All 
stress margins were verified by ultimate load test, element by element, for design loads. 

All design lift-off loads have been generated using a 2-sigma worst-on-worst 
parameter variation approach which indicates that the nominal strut load expected should be 
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around 60 percent of the design load. Reconstruction of 51-L loads showed this to be the case 
(see Presidential Commission report). Also, remember that the design strut load added only 
7 percent to the total gap opening (fig. 58). In other words, for 51-L MLP post loads, SRB 
and ET tip deflections, propulsion system thrust, etc., were all near nominal. Only the 
ambient temperature was low. In addition, full-scale SRM segments were tested with and 
without strut loads in conjunction with numerous o-ring/temperature tests, etc. that fully 
verified the analytical model. Prior to STS-26, a full-scale hot-firing of the redesigned SRM 
was conducted with maximum expected strut loads. Special instrumentation was used to 
measure various effects. This was the final verification of the analytical models and the 
worthiness of the redesigned motor for flight. 

(b) Post-Lift-Off Through Max Q: Actually, for this area more data are available for 
reconstruction than for lift-off from the dynamics and loads standpoint. Again, six of the first 
seven flights, plus flights since 51-L, have measured loads data to verify the reconstruction 
process. The measured data for this flight regime include the vehicle position at all times from 
radar tracking and from the onboard guidance system (position, velocities, and accelerations). 
Control data gave the instantaneous vehicle angular and lateral positions, velocities, and 
accelerations along with the thrust control system responses. Propulsion system data include 
pressure, thrust, temperature, etc. Wind data are obtained prior to flight and 15 min after 
flight. The vehicle responds very quickly to all wind shears and gusts and is reflected accu- 
rately in the control system/vehicle response data. The process of reconstruction is well 
established starting with Saturn and other programs. First, the trajectory is reconstructed 
from the radar tracking and onboard guidance (data best estimated trajectory) (BET). This 
reference trajectory (BET) becomes the base for all other reconstruction. The next step takes 
all propulsion system, mass (weight), etc., data and reconstructs a trajectory to match the 
BET. This reconstructed trajectory is the base for control, loads, thermal, etc., reconstruction 
analysis. Next, the wind speed, shear, and gust profile is estimated from the measured wind 
data taken prior to and after flight. These data, in conjunction with the propulsion, weight, 
etc., data from the reconstructed trajectory, are used to perform the control system/vehicle 
response reconstruction. These data are correlated directly to the telemetered control system 
data mentioned earlier. Loads such as strut load can be directly calculated from these data. 

Figures 59a and 59b are examples of how well loads were correlated on STS flight 6. 
These same reconstructed data for the 51-L flight showed that although the winds were high, 
less than 60 percent of the design wind shears and gusts were experienced. Also, because 
loads are generated using 3-sigma parameter variations, loads were well below design 
levels; therefore, they would not be a primary cause of the failure. The 51-L failure was 
caused by the faulty SRM joint/o-ring which, through the impinging leaking gas, caused the 
vehicle failure. Photographic coverage of the flight clearly showed the leaking gas. The failure 
of the SRM internal pressure to rise back after max q correlated to the observed leaking 
plume size. Reconstructed aerodynamic shifts were required for this effect to match the con- 
trol response. See the Presidential Commission report for details of this reconstruction. 

Technically the basic message is that one must read what development and 
operational hardware is telling you. It has the answers. Also, one must understand clearly all 
the phenomena and sensitivities of the system. To understand a failure, ruling out potential 
causes is just as important as finding the real cause. System data are very important in all 
these cases and are the backbone of design as well as failure investigation. 
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The next section addresses the resulting loads characteristics of the space shuttle and 
the system implications. 

(6) Loads : References 4 and 14 give examples of shuttle loads for both lift-off and 
max q. The sensitivity of loads due to the large energy stored and the complex static and 
dynamic configuration were alluded to. One important item was not discussed, namely design 
factors, etc. Looking at the system, it is easy to see that 1 lb of ET or orbiter weight savings 
is equivalent to 1 lb of performance increase. On a vehicle that is performance critical, loads, 
thermal, and other environments must be very accurately determined. Conversely, a decrease 
of 10 lb of SRB/SRM weight is equivalent to 1 lb of performance increase. Therefore, it was 
decided early that the SRB/SRM design environments would be maximum/minimum to build 
in robustness and eliminate redesign as environments change downstream. The tank and 
orbiter, however, used 3-sigma time consistent loads to save weight. The tank loads that 
were well defined had only a 1.25 safety factor applied to the limit load to provide a safety 
factor versus the 1.4 normally used. As a result, as loads and other environments evolved, 
the SRB/SRM design did not require change. Design changes had to be made to ET for these 
same loads. This is a good example of using system analysis and proper cost guides to set 
the best design. Many other system loads problems, such as aeroelastic effects, both static 
and dynamic, have been studied and incorporated into the design. No known problems have 
occurred in these areas. 

(7) Loads. Control. Thermal Interaction : It was alluded to earlier that the original 
shuttle parallel burn configuration had no control authority on the SRB’s. In fact, this control 
was not baselined until early phase C. The shuttle vehicle is aerodynamically stable, hence, it 
naturally turns into the wind and drifts. Also, the large aerodynamic forces would introduce 
drift, thus, performance loss. This meant that classical trajectory optimization could not be 
used, but must include moment balanced (control and aero) simulations. In addition, it was 
found that although the vehicle was aerodynamically stable, it could not turn into the shears 
and gusts fast enough to reduce loads, hence, load relief control was required. This derived 
requirement indicated that more control authority was needed to handle this problem; for 
example, using the orbiter's elevon and/or a trim system on the SRB’s. The problem was 
compounded by the unsymmetrical configuration which caused the vehicle to roll. Many 
argued that one should "let it roll" during atmospheric flight; however, adding the effects 
together produced large performance losses and increasing loads. 

During this timeframe, historical data from the then in-use solid programs would only 
produce a thrust vector nominal alignment within a 1° circle per SRB. Looking at the total 
configuration with the large moment arms of the SRM thrust, neither the orbiter elevons nor 
the SSME’s gimbaling authority could take out this SRM thrust misalignment effects on the 
control and trajectory shaping. 15 Figure 60 shows this effect. Obviously, the best place to 
counteract the thrust misalignment effects was at the source — gimbal the SRM nozzle or go 
to secondary injection. It was decided to gimbal the SRM nozzles. 

An additional driver to the requirement for SRM gimbaling was the SRM thrust tail-off 
regime. Here the thrust unbalance between the parallel SRM’s creates torques that must be 
controlled out. Neither the SSME nor elevon control could do the job (“q” too low for 
elevons). 
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Since performance was becoming a problem, weight reductions were in vogue for all 
shuttle elements. It was found that some performance could be gained by rolling the vehicle 
and putting the orbiter underneath the system which allowed the SSME side thrust 
(introduced cant angle required to track the center of gravity (C.G.)) to counteract gravity. 
The SRM gimbal capability allowed this option to be taken. At 20 s into flight, the shuttle 
was rolled to place the orbiter underneath the stack. Now then the vehicle had the authority 
to control it throughout flight. Load relief could be beefed up. None of this comes without cost. 
Controlling the vehicle and adding the load relief control options produced large drifts. Once 
out of the high dynamic pressure regions, the vehicle could be controlled back toward the 
optimum path. This introduced large angles-of-attack and side-slip which introduced large 
thermal loads. In the end, the system had to balance between these conflicting requirements. 
The system flies with pitch and yaw accelerometer load relief gains, rolls the vehicle to 
minimize loads, and has elevon load relief to reduce orbiter loads. 

(8) Aerodynamic Wing Load/Performance : As mentioned earlier, the prediction of the 
aerodynamic distribution and vehicle movement for the orbiter wing was missed due to 
improper SRB and SSME plume simulations for wind tunnel testing. This simulation had to be 
accomplished by developing equivalent cases which represent the airflow influence of SRB 
and engine plumes. This was not easily accomplished since accurate prediction tools were not 
available. This caused the STS-1 vehicle to loft higher than predicted. Measured strain data 
on several flights, additional wind tunnel testing, and analysis showed the wing loads to be 
higher than predicted. Since the trajectory (performance), loads, control, launch probability, 
and dynamic pressure are strongly coupled for this unsymmetrical vehicle with large aero- 
dynamic forces, how to handle this problem was not easy. Figure 61 illustrates this coupling 
and where the vehicle must fly if the wing was not fixed. Three options were open (1) fix the 
orbiter wing (structurally beef up), (2) constrain the flights to specific winds (lower launch 
probability), or (3) fly off-nominal trajectories to reduce the load (performance less). In the 
end, all three options were used to various degrees. The orbiter wing leading edge was 
beefed up to allow more negative angle of attack. The trajectory was reshaped at about 
5,000-lb performance loss to reduce dynamic pressure and loads. (Dynamic pressure limits 
are also imposed from flutter and buffet.) The flights are constrained to certain wind condi- 
tions using day of launch wind monitoring and day of launch I load updates. Figure 62 illus- 
trates the characteristics of the wing load versus angle of attack and the trades required to fly 
the more negative angle of attack. 

Figure 63 shows the q envelope versus Mach number designed to (solid lines) and 
one set of limits imposed from the change zero data base. Limits are still evolving as more 
flight data are obtained. Where a -2° tilt trajectory was optimum, the trajectory is currently 
changed to fly around -6° creating the approximately 5,000-lb performance loss. Coupled with 
that is a reduced launch probability to around 70 percent for the windiest month. 
Operationally, each launch has to have a special trajectory and loads analysis coupled with a 
detailed day of launch constraint program, procedures, and criteria. 

(9) Overpressure : Shuttle overpressure was treated extensively in reference 16. 

Overpressure is a pressure wave engulfing the vehicle, caused by the very fast SRB thrust 
build up, compressing the entrapped air in the flame trenches. Figure 64 illustrates this 
phenomenon. STS-1 experienced large overpressure loads at lift-off, exciting the vehicle 
structural dynamic modes to near a dangerous level. Fortunately, during shuttle phase A and 
B studies, a 6.4 percent propulsive model was built to evaluate acoustical characteristics. 
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This model served as a test bed to understand, design, and verify a fix for the overpressure 
problem. Figure 65 is a picture of this propulsive model and the launch pad. Through approxi- 
mately 50 scaled hot fire tests a fix was developed. It consisted of spraying water into the 
SSME and SRB plumes through modification of the acoustic suppression water flow, plus a 
series of water troughs installed to block residual waves not suppressed by the ingested 
water (fig. 66). It is still debatable whether the troughs are required; however, the cost is 
minimal for the added insurance. 

Clearly the problem has been fixed. Figure 67 shows the STS-1 overpressure valves 
before the fix and the data measured since the fix. 

(10) Acoustics : Since the payload (piggyback configuration) is near the noise source 
(SRB and SSME thrust exit), noise reduction had to be employed to keep payload bay 
acoustics at an acceptable level. This was the reason for developing the 6.4 percent propul- 
sion and launch pad model. Through numerous tests, a water suppression system was 
designed and verified to handle the acoustic problem. Figure 68 shows the effect for the 
SSME-only burning. Figure 69 shows the overall sound pressure level reduction as a function 
of water injection. Through this extensive program during the technology and design phase, 
the acoustics were controlled which allows efficient payload designs. 

(11) SRB Ho lddown Bolt Hangup Versus Debris : Early in the shuttle flight program, 
it was observed (film coverage) that occasionally an SRB holddown bolt would hang up and 
scar the bolt hole in the aft skirt as the vehicle lifted off the launch pad. The design is such 
that the holddown bolt secures the vehicle to the pad until launch. At SRB ignition, two 
pyrotechnics units fire, fracturing the nut that holds the skirt to the pad through the bolt. The 
bolt is designed and pretensioned so that the bolt moves away (assisted by gravity). There 
is a cover over the explosive nut to catch debris. Figure 70 shows the original configuration. 
As a result of the bolt hangup observations, a detailed study was made as to the cause and 
effect. Lift-off simulations showed that no lift-off problems would occur due to hangup. The 
cause of the hangup was due to the timing differences between the redundant pyrotechnics. 
Work was accomplished to reduce this timing difference thus reducing the possibility of 
hangup. 

As the program progressed and orbiter tile damage became a larger problem, a con- 
cern was raised that the nut fragments could be coming out the bolt hole causing debris. The 
system was redesigned to control the debris but induced more bolt hangup, due to the attach 
linkage of the spring to the holddown bolt. This had to be redesigned to solve this problem, as 
shown in figure 71 and 72. Those design changes have basically eliminated the debris and the 
bolt hangup concern. 

d. Saturn I 

In section VI, the complexity of dynamic characteristics of the Saturn I vehicle and its 
coupling with the control system are discussed. That discussion will not be repeated here. 
There are, however, technical messages to be drawn: (1) boundary conditions and the ability 
to quantify them arc key to test verification, and (2) analysis, data, testing, etc., are only 
valid within the assumptions used. Stretching the limits, in general, leads to errors. 
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3. System Conclusion 

Suboptimization versus system optimization (total cost), in general, is costly. The 
space shuttle, although an outstanding vehicle, is costly to operate because of these induced 
problems. Many other examples can be cited for other systems, as well as things as simple 
as running tests without instrumentation just to make a milestone. The message is always 
the same regardless of the project, activity, etc. Deal with total cost to make decisions, even 
if it can only be done by judgment. For example, the decision to conduct the all-up mated 
shuttle dynamic test was made in this judgmental manner using trend charts. Dynamic 
characteristics were required for control system design, POGO suppression design, flutter 
avoidance, and loads. Partial dynamic model verification could be accomplished using scale 
model and element tests for the final verification with an all-up full scale. Figure 73 shows a 
relative ranking of what each test would buy in lower risks. This assessment showed that the 
driver for mated vertical ground vibration test (MVGVT) was the data for control system 
design. The trade was clear: one could get accurate dynamic data and design a simple robust 
control system, or one could have less accurate structural dynamic data in conjunction with a 
complex adaptive control system (fig. 74). Load relief was a part of this trade. The decision 
was clear, even without precise cost data, that it was better to conduct the dynamic test and 
use the simple robust control system. Figure 41 was an attempt to show the above described 
shuttle evolution in requirements and design and the resulting operational system. Although 
the system is excellent, the cost, etc., is much higher than predicted, basically due to con- 
straints and outside requirements. This means that for future systems, the total cost function 
must be used in conjunction with up-front analysis and testing to identify key parameters and 
their sensitivities coupled with constant review of requirements and performance, particularly 
the derived requirements. It must be understood that many of the requirements for design are 
derived requirements obtained as analysis and when tests are conducted. The more these can 
be identified prior to phase C, the less costly the design phase will be. 

B. Fourteen Guiding Principles 

As mentioned previously, a set of 14 guiding principles has been developed to support 
the system focus and highlight design practices (Fig. 75). These were discussed in detail in 
reference 4. A few were selected for discussion in the seminar and are documented here. 

1. Performance Requirements 

Coupled strongly with the system focus is the principle that the higher the per- 
formance requirements, the greater the sensitivity of the system, subsystem, or part to 
variations in any parameter, including manufacturing, environments, tolerances, etc. Figure 76 
is a curve illustrating this principle. The standard SN-curve is in general the inverse of this 
curve. 


The system performance requirements determine the design, technologies, penetra- 
tions, etc., necessary to meet the goal of a safe reliable system. Performance requirements 
are always broad in scope, encompassing not only the response but also all the characteris- 
tics from design through operations. The higher the performance, by definition, the greater the 
sensitivity of the design to uncertainties. Uncertainties exist in all areas of design: materials 
properties, environments, analysis, testing, manufacturing, etc. 
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Design in the flat portion of the curve can basically be dealt with in a linear fashion. As 
the design moves out on the curve into the steeper slopes, nonlinear analysis is implied. In 
the first case, the design is inherently conservative and easier to predict since super position 
works and the nonlinearities not used to gain margin are still present and add to the margins. 
(Nonlinearities in general are conservative.) In the latter case (high performance design), use 
must be made of the nonlinearities in order to meet design margins and performance criteria. 
It should be pointed out that nonlinearities are not easily predicted or analyzed and are more 
sensitive to unknowns and changes. If the performance requirements are such that the design 
is inherently in this region, then great care and accuracy must be taken to develop data bases, 
define environments, and perform analyses, etc. Manufacturing, nondestructive investigation 
(NDI), quality control, and acceptance criteria parameters must be enhanced. If, however, one 
designs for robustness, the lower portion of the curve depicts the system, providing margin of 
the performance index. The optimum lies somewhere between the two extremes. The curve 
can also be shifted to the right and down through data acquisition and increased knowledge, 
in many cases a desirable approach (technology advancement). At the onset and periodically 
throughout the program, sensitivity studies must be made to determine where the design 
rests, what parameters should be made robust, and what the real optimum is, considering all 
factors. 

Another way of looking at this principle is to plot two parameters, robustness and 
performance, concurrently versus requirements. As the requirements increase, performance 
level must increase while in general the inverse is true of robustness (fig. 77). The curves are 
shown in a generic fashion, where in specific terms the requirements, performance, and 
robustness would shift relative to each other. Ideally, the design should balance best in the 
large box centered where the two curves cross, producing some balance between 
performance, robustness, risks, and cost. In the space business, as well as many others, the 
trend is to apply linear thinking, with performance as the focus, thus ending up with the 
design in the box at the far right or somewhere in between. This produces the results 
previously discussed. What is required is that the linear thinking loop must be broken and 
lateral thinking invoked, which jumps to the side and plays the game differently using 
reliability (robustness), total cost, and performance in the balancing act. Lateral thinking is 
also implied if one wants to shift the relative merits of the two curves. Clearly this shift 
requires some creative jump to do things differently than the standard practice. Once the 
lateral thinking jump has been made, the linear thinking approach takes over and serves well. 
In fact engineering basically is so founded. 

Two examples from the space shuttle program will be given to illustrate the reality of 
the performance sensitivity principles: (1) The 4,000-Hz SSME buzz, and (2) shuttle lift-off 
loads. The SSME is a very high performance system that, on the lox flow side, has a very 
high dynamic pressure environment. As a result, various coupled structures are very 
sensitive to flow and acoustic/structural interaction problems. The main injector lox inlet has 
a two-blade splitter in order to create a more uniform flow distribution into the lox dome (fig. 
78a and 78b). Vane protrusion into this high-flow environment is susceptible to flow-induced 
oscillations and, thus, fatigue failure. This occurred on the inlet splitter. Three engine units 
have had cracked splitters. These fatigue cracks are believed, based on analyses and tests, 
to be caused by vortex shedding off the vane trailing edge, occurring at the vane natural 
frequency of 4,000 Hz. In addition to the three splitters with cracks, several other units have 
shown the 4,000-Hz phenomenon, but at a lower level, without cracks. The amplitude 
determines the alternating stresses, hence life. Figure 79 shows a spectrum of an engine 
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response with and without the 4,000-Hz buzz. The without is the same engine with the 
splitter modified to eliminate the buzz. Notice the narrow band sharpness of the tuning. The 
interesting part is that 20 percent of the engines buzz, the others did not at any time in their 
test history. The buzz cause has to be due to small manufacturing differences in the bluntness 
of the vane trailing edge and possibly small vane angle/offset differences or slight modal 
shifts. To understand and solve this problem, extensive scale-model and full-scale flow 
testing, static testing, dynamic testing, hot fire testing with special instrumentation, and 
analysis was required over a 3-year period. The solution was to sharpen the vane trailing 
edge and put a curve wider gap between the leading edge of the two vanes. No buzz has 
occurred since the fix was implemented. 

The space shuttle lift-off phase falls into this same category. There are several 
problems or sensitivities associated with the shuttle lift-off (fig. 80). Most of these, SRB aft 
skirt, debris, overpressure, and acoustics, have been discussed in earlier sections. The pad 
and tower clearance has not been a problem but required detailed dynamics and control 
simulations to define drift envelopes, operational requirements, and control system settings. 
Simulations have been verified using control data (vehicle state) and camera coverage. 

The lift-off loads have been one of the vehicle and its elements key design drivers and 
are very sensitive to parameter uncertainties. Design loads must be generated for each time 
slice of the mission profile peculiar to the part it designs. Not only must the loads data be 
generated for nominal operating conditions with parameter variations, but for aborts and 
contingencies also. The lift-off sequence as well as its dynamics were discussed in a 
previous section. The aft skirt is designed by the weight and the stored moment introduced by 
the SSME thrust and by the abort case which produces not only the peak moment but several 
oscillations for LCF concern. Lift-off loads occur after SRB release and are a very dynamic 
situation resulting from the released stored energy and dynamic tuning between the five 
elements connected by interfaces (spring) (fig. 32 and 33). Two SRB’s, ET, orbiter, and 
payloads produce these dynamic elements. The vehicle loads of this event are very sensitive 
to small changes in the elements or the input parameters. Payloads, the element interface 
hardware, and other hardware are designed by these lift-off loads. 

Major efforts have been expended to first develop and verify structural dynamic 
models using finite element analysis, scale model, and full-scale testing. Constructing a 
systems model, including the dynamics of the launch platform, was a major challenge. The 
definition of the parametric inputs with the statistics definition of variations for things such as 
thrust, thrust vector offset, thrust misalignments, masses, winds, etc., in addition to 
dynamics, pushed available technology. The final big hurdle was the development of a 
technique that could handle time delays, nonlinearities in the development of a statistically 
quantified time consistent sets of loads. A 2-sigma worse-on-worse parameter time 
consistent combination was first used requiring approximately 30 different design load sets. 
Monte Carlo time varying analysis has been used to further quantify these loads. 

With the baselining of these procedures and criteria and the various loads analyses, 
sensitivities became clear. Model refinements of the vehicle and pad were necessary. In 
addition, the number of structural modes required for accuracy of loads predictions increased 
first to 200 then to 300 modes below 30 Hz. Figure 8 1 shows the difference in the HST loads 
for the different design load cycles, compared to the original design values. A factor of 2 
increases on the secondary mirror occurred as did smaller increases of other components. 


23 



Changes of this magnitude can be expected for multibody low-damped structural systems 
with elements whose frequencies tune. It is aggravated by the unsymmetrical configuration 
increasing the coupling. 

4 

As stated previously, for these high sensitivity regimes, extreme care must be 
exercised in determining characteristics and operational criteria. As a result of these high 
tech requirements, the reliability of the system requires greatly increased technology for 
testing, analysis, manufacturing, quality, etc. Operations also, in general, become more costly 
with tighter constraints and loss of flexibility. Does this mean that high tech design is not 
pursued? In no way; however, increases in knowledge (technology) are required with tighter 
acceptance controls. This means that judging a design’s accuracy requires understanding the 
operation point on the sensitivity curve. 

2. Analysis and Test Are Limited 

All simulations, models, symbols, patterns, etc., whether dealing with analysis, test, 
management, etc., are just that, models which are not complete (limited) and are not exact 
representations of reality but are mathematical or physical representations or symbols with 
various assumptions of these facts. 4 

The principle must be fully understood so that everything is constantly challenged for 
applicability. The major problem we deal with is how this less-than-reality information is 
meshed together to get verified, reliable systems. Obviously, this can only be done in some 
probabilistic sense. In addition to the use of robust statistical approaches, how the limitations 
of models, tests, etc., are dealt with determines the design outcome. There are many ways of 
approaching the question; however, the fundamental approach appears to be a building block 
approach using a combination of analysis and test. Fundamental to this approach are the 
following steps: (1) formulate model, (2) perform pretest analysis and sensitivity studies to 
guide test, etc., (3) perform test with proper instrumentation, (4) correlate predictions and 
test, and (5) update model to produce verified model. 

The space shuttle SRB aft skirt failure illustrates this limitation. Early shuttle loads 
analyses conducted using simplified models of the launch pad and the SRB skirt produced a 
set of loads thought to be accurate for the prelaunch SSME thrust buildup phase of launch. It 
was understood that major skirt load would arise from vehicle weight combined with the 
SSME thrust force. At full thrust, the four holddown posts away from the orbiter are loaded in 
compression, not only from weight but also from the vehicle bending due to the SSME thrust. 
What was not understood was the sensitivity of the local weld stress near the holddown post 
to the pad stiffness (fig. 44) as discussed previously. 

Part of the loads sensitivity of the aft skirt is due to the holddown mechanism which is 
composed of the spherical bearing, bushing and aft skirt shoe (fig. 82). As shown on figure 83, 
the bushing is offset so that the mating of the SRB to the pad could be enhanced. Since the aft 
skirt load is a function of the radial displacement of the skirt of the post, this symmetry can be 
used to prebias the skirts post inward, reducing the effect of the applied load and thus 
increasing the structural margins (fig. 84). This approach is being used currently on shuttle 
flights to increase the margins. 
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3. Configuration Complexity Determines Penetration 

Just as important is understanding the configuration complexity. It should be pointed 
out that in many cases the attempt to solve one problem, even though simple, can create 
problems in another area. Two areas will be discussed: (a) dynamics and (b) static ldad 
paths. 


a. Dynamics 

Dynamic systems are fairly predictable if they are basically a single body without 
extreme geometric ratios. If the configuration is composed of several separate bodies 
connected by the links, etc., the characteristics are those of a redundant structure and become 
more unpredictable and sensitive. The bodies can dynamically tune, greatly amplifying the 
response and reducing prediction accuracy. Reference 17 addresses the history and classes of 
problems that have had their roots in complex dynamic configurations. 

b. Static Load Paths 

Static load paths are in the same category. The simpler the load path, the greater the 
predictability; the more complex the load path, the less predictable. Unsymmetries worsen 
the situation by loading both in bending and shear, coupling everything together. These 
complexities produce stress concentrations, quality control problems, and nonplanar stress 
fields, driving requirements toward more detailed analysis, testing, etc., to properly 
characterize the system. 

Configuration complexity is obviously a driver in determining adequate design. 
Literature abounds with guidelines in these areas. 

4. Bracketing Hand Analysis is Key to Understanding 

One of the most important general principles is to make simplified hand analyses to 
understand the phenomenon and guide more indepth computer evaluations. These should 
include free body diagrams and flow schematics to provide visualization. A fundamental part 
of this approach is the determination of the extreme or limiting cases. By establishing the 
physical understanding of a problem and its bounds, greater insight and more efficiency are 
established. 

It cannot be emphasized enough that the fundamentals can only be grasped if we 
maintain the ability to be fundamental. Use the computers and testings to aid the human 
mind, not in place of it. Good design rides on this. 

5. People Are the Prime Resource 

For verified hardware to result, it must be recognized that people are the prime 
resource for accomplishing the tasks. The only real resource we have to tape and motivate is 
the human engineering exhibited in the diverse personalities in the organizations and how 
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they utilize the available tools/resources. Management must recognize where the power is 
and put its emphasis on the major resource — people. All else are tools for making them more 
efficient. 

Saying this means that the first and foremost task of management and control is 
leading people, the prime resource. What can managers do? Nothing much new is on the 
scene, however, basic principles alluded to by Drucker , 26-30 Peters , 24 31 32 Deming , 21 and 
others, need repeating. First, whatever the individual has of value to the organization is 
within himself. As Drucker says, “His development is not something done to him, it is not 
another or better way of using existing properties. It is growth, and growth is always from 
within. The work therefore must encourage the growth of the individual and must direct it.” 
This means that individual responsibility is the key to performance. The discussions, 
judgments, innovations, assumptions, etc., that take place at all levels are the ingredients 
that determine design goodness. The source of this information and judgment is the human 
resource, the individuals with their individual differences, that must be used, heard, and 
melded together. 

6. Criteria 

Criteria or legal requirements must be simple, concise, and direct, providing order to 
the engineering process; but not overpowering to where it stifles creativity and removes 
responsibility. 

The balance between criteria (formal organizational structure) and creativity (informal 
organizational structure/leadership) is probably the most challenging task engineering faces. 
Legal all-encompassing criteria produces order, but if excessive, removes responsibility, kills 
innovation, suppresses opportunity to find the best solution, and stifles creativity. 

“Optimal performance needs administration for order and consistency (formal), and 
leadership (informal) so as to mitigate the efforts of administration on initiative and creativity 
and to build team effort to give these qualities extraordinary encouragement. The result, then, 
is a tension between order and consistency on the one hand, and initiative and creativity and 
team effort on the other. The problem is to keep this tension at a healthy level that has an 
optimizing effect.” “Servant Leadership,” by Robert K. Greenleaf. 

Criteria and requirements are generally written to include guidelines, procedures, and 
implementation schemes. This ought not to be. Criteria should be very concise and specific, 
without justification, guidelines, etc., and should be based on sound engineering 
understanding. There is a need for guidelines, procedures, and implementation schemes 
including engineering equations, computer codes, instrumentation plans, test approaches, 
etc.; however, they should be produced as separate documents and not be legally binding. 
Greenleaf stated the case well in emphasizing the creation of teamwork. Teamwork is the 
method for insuring the quality product. It is mandatory that government and industry, project 
and engineering, etc., work as a team. If any group becomes a priest, the judge, excessively 
binding the others in a legal manner, they destroy the team effort along with creativity. Space 
engineering is always pushing the edge of technology, requiring the optimum development of 
creativity in order to meet the combined performance, risks, and cost goals. This means that a 
constant awareness and struggle is required to balance between the legal (criteria) and 
creativity (informal) of the individual. This is one of the highest priority tasks. 
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III. LESSONS LEARNED 


The lessons learned are the basis for the principles derived and, in some cases, 
parallels these principles. Figures 85a and 85b contain a partial list of the lessons learhed. 
Many of the lessons learned reinforce the theories and practices of TQM or quality 
enhancement. The team approach with open communication is key and can be tagged as 
simultaneous engineering, etc. The early use of constraints can undermine a design such that 
its performance and quality can never be fully recovered. What is recovered is bought at a 
high price. This is part of the system focus which leads to system analysis and testing as 
discussed previously. One could write a report by rehashing these lessons learned. Most 
stand alone and therefore are left for the reader. Reference 4 contains a more comprehensive 
listing of lessons learned and design guidelines. 


IV. DESIGN GUIDELINES 


Design guidelines are not always generic in nature. Designing a liquid propulsion 
engine is different from designing an air frame. There are, however, some general design 
guidelines which are listed on figure 86. For example, one cannot design currently envisioned 
space vehicles or spacecraft without insuring manufacturability and inspectability. Welds are 
a more efficient means of connecting structure; however, the design should not feed peak 
stresses into the welds. Weld lands can be used as a means of reducing excess stress as 
well as weld shaving. Elimination of three dimensional dynamic coupling is a good design 
goal. Where it cannot be eliminated, adequate frequency separation should be employed. 
Design in the linear range should always be the goal, using nonlinearities for operational 
margins. Margins must be specified and verified. Margin statements can be either 
deterministic or probabilistic. This leads to the requirements for criteria, procedures and 
philosophy to match the program. As a general statement, criteria used for design should be 
deterministic; reserving the probabilistic for sensitivities and reliability; however, modern 
computers in conjunction with basic statistical code development is making the probabilistic 
approach a viable option. Limitations of analysis and test must be accounted for in design. All 
design must be against total cost and should consider flexibility. What is not put in the design 
must be made safe by operational procedures. Good design accounts for environment 
variations through robustness of the response or through control of the environments. 
Instituting automated data base should be a part of good design to enhance verification and 
operations. 


V. ENVISIONAL TASKS 


As one looks to the future that includes planet Earth, lunar colonies, and Mars 
exploration, certain tasks of a broad nature are envisioned. The first is design and 
implementation of fracture control with all its associated tasks. Implied also is the 
development of health monitoring systems. Future designs and effective implementation of 
TQM will require simultaneous engineering including interdisciplinary analysis (system 
focus). The list on Figure 87 is representative, but not all inclusive. The individual mission 
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requirements, coupled with the design concepts, will determine the range of interdisciplinary 
analysis. The system focus must use total cost as the criteria that the decision process 
employs for design selection. Many of the systems proposed for the future must deal with 
geometric and materials nonlinearity. Analysis techniques, testing techniques, and materials 
characterization must be developed for these tasks. Combined testing, probably on orbit, 
must be developed to verify systems. This includes instrumentation, mission planning, and 
software updates to account for anomalies found. Statistical/reliability applied mechanics 
techniques must be developed to properly assess risks. All discipline technologies must be 
extended to cover the new requirements. Robustness and sensitivity techniques must be 
extended to cover mission requirements in the design process. The customer (requirements) 
and their continuous interaction with the project is the key to success. TQM is the overall 
approach that must be used to ensure all these things are done to obtain a low cost, robust 
system. 


VI. PERSONAL LESSONS LEARNED 


Most personal lessons learned are not of much value to others due to the situations 
involved; however, a few encountered have particular value for engineering, especially 
aerospace engineering. 

Most of us envision ourselves as great thinkers, observers, and discoverers. As 
engineers, we write of our investigations, evaluations, and lessons learned, giving little credit 
to the influence of others. Yet, if reality is approached, “No Man is An Island,” much of what 
he projects was taught by others. As Deming says, “we cannot generate knowledge; it 
comes from outside,” Norman Cousins, while editor of Saturday Review, and serving as a 
Presidential advisor, had the opportunity of asking several of the world’s great men the 
question: “What is the one lesson you have learned in life?” Each of us must pose the 
question and extract answers, many times simple in nature, at other instances complex and 
multifaceted. One lesson marked clearly in my mind is that I am, to a large extent, what I am 
because of others. Obviously, our parents, friends, teachers, etc. have all played a part. I do 
not want to minimize that; however, the examples chosen of lessons others taught are taken 
from my professional life and will be geared toward an engineering application. 

A. Lessons Learned from Dr. von Braun 

Dr. Wemher von Braun, the great German space leader who was in the forefront of 
much of America’s early space program through the Apollo lunar landing, taught me a lesson 
that is deeply etched in my mind. As a young engineer, I was given an assignment associated 
with clearing the first Saturn I launch vehicle for flight. The results had to be presented to Dr. 
von Braun. The Saturn I, first stage, consisted of a core propellant tank (Jupiter missile 
manufacturing) surrounded by eight propellant tanks (Redstone missile manufacturing) and 
eight clustered engines. The upper stage of this series-burn vehicle was a Saturn IV stage 
consisting of four R-L10 engines (inert on the first flight). Due to the potential for the vehicle 
elastic body modes coupling with the control system, producing an instability, and the 
dynamic complexity of clustered first stage tankage, accurate modal characteristics were 
required. Analytical structural dynamic analysis, verified by a full-scale dynamic test, was the 
chosen approach. This being one of the early full-scale dynamic system tests, much concern 
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existed in terms of the elastic suspension system (attempt to simulate free-free modes) 
coupling and distorting the experimental mode shapes. Early attempts to remove this effect 
from the experimental data produced errors, poor correlation with analytical data, and control 
system instability. My assignment was to show that the suspension system was not 
affecting the data since the analytical mode shapes correlated adequately with the dynamic 
test, thus it was safe to fly. The problem was that many modes of the clustered configuration 
were very closely grouped in frequency. If the frequencies matched the test data, the mode 
shapes did not and vice versa. As any good dynamist knows, if the frequencies are close, 
then usually the critical match is modal, not frequencies. However, because of the emphasis 
that had occurred, it was decided that the correlation would be made on frequencies, not 
modes. Dr. von Braun quickly saw the discrepancy and nailed me to the wall. After some 
discussion, he said in a nice way: “I think you are trying to fool me; however, I don’t believe 
it will affect the results of your study or the conclusions, so let’s hear the conclusions.” The 
conclusions were that the data, both analysis and test, were accurate. Therefore the control 
system was stable and it was safe to fly. The vehicle flew successfully. The lesson is clear; 
never shift the emphasis away from a basic for ease of presentation, stick to the 
fundamentals. At the end of the meeting, someone questioned Dr. von Braun over the wisdom 
of holding up a launch for two weeks to investigate a supposition. He answered with a 
question: “What if he had been right? We have time to find out.” Such is good engineering. 

B. Lessons Learned From Dr. Geissler 

Early in my career. Dr. Ernst Geissler, our Laboratory Director, taught me a very 
embarrassing, but equally permanent, lesson. My supervisor had given me a set of equations 
to solve and graph the results. He told me that he would not be in the next day and that I was 
to give the results to Dr. Geissler. This, I did. It turned out not to be simple. Dr. Geissler 
took the information then asked me to explain it. Since I was only following instructions and 
had not been told what the equations were for, I had to say that I didn’t know. Dr. Geissler 
obviously knew what had happened, saying in his quite gentle manner: “Mr. Ryan, we 
always have time to understand the results and what we are doing.” Clearly this is a basic 
that engineering must adhere to. 

C. Lessons Learned From Mr. Horn 

Helmut Horn, my Division Chief, had a unique way of working problems. Many times, 
late in the afternoon, he would call me in to explain some problems. His technique was to 
have you go to the chalkboard and explain algebraically and graphically the analysis and the 
problem. Somewhere in this exchange, he would take the chalk and start constructing 
simplified models to use for interpreting your data. In one of these exchanges, I was 
presenting Saturn V elastic body modal response to the atmospheric winds, including the 
induced aerodynamic forces. I was treating the problem using the Lagrangian approach and a 
set of generalized coordinates and generalized forces. His goal was to show that the 
distributed aerodynamic force and generalized coordinates for one mode could be represented 
by a single mass spring damper system with a single point time force recoupled from the 
other modes. This, I was able to do, but with much discussion required for the analogies. As I 
remember, this went on late into the early evening. All at once, he stood up and shook my 
hand making the statement: “You have done your homework.” Then added: “We must 
always try to understand our model, our analysis, with a very simple physical representation 
of the problem. When this works, the answer is simple. If this simplified physical 
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representation doesn’t work, then we must be able to explain why it fails and thus justify or 
verify the more sophisticated analysis.” Needless to say, that day is locked in my memory. 
The capability and complexity of modern day computers and the expanding scope of analysis 
makes this principle even more important. 

D. Lessons Learned From Dr. Rees 

Dr. Eberhard Rees, Marshall Center Director following Dr. von Braun, taught a very 
important lesson in that we must, as managers, have real concern for people. Dr. Rees 
decided late in a Friday afternoon briefing, preparatory for a Saturday Headquarters meeting, 
that I needed to accompany the group to Washington Friday night and Saturday. This created 
some problems for me since I had a Sunday appointment that could not be easily broken. Dr. 
Rees promised that he would see that I got back. We were using the NASA Gulfstream 
plane for the trip. Late in the afternoon Saturday, a snow started. The meeting was kind of 
depressing due to the decisions reached, so after getting on the plane, I slumped down in my 
seat. Soon, after Dr. Rees got in his seat, I heard him say: “Where is Bob Ryan? I promised 
him we would get him back tonight.” An expression of real concern in a very simple way 
makes lasting impressions. 


E. Lessons Learned From My Dad 

When in high school studying algebra homework, I got stuck somewhat. Not wanting 
to spend much time on the assignment, I turned to my dad whom I knew could work the 
problem. Instead of working the problem and explaining the solution to me, in his great 
wisdom, he asked me a question or two that forced me to think the problem through and work 
it myself. Obviously, I was frustrated for awhile, but in the end, I was happy because I 
understood the principle. In working with people and getting them to develop, we need to 
follow this example. Our goal should not be to get the quick answer, but get the answer in a 
way that develops the person. 


VII. FUTURE THRUST (TQM) 


TQM is a revolutionary concept that is transforming America through a change of 
focus, new principles, and better tools, resulting in better quality, lower cost products and 
services, and, consequently, a better quality of life. This concept fits all of us. We all have 
a product to sell, a product to produce. Therefore, we all must define what our product is 
and who the customer is. The process works by identifying what the product is, how the 
product is made, how it is to be used, and what the total cost is. The concept focuses on 
bringing a team concept up front to do the job better using simultaneous engineering, and 
involving the customers and all product disciplines from conception to operation. The team 
determines requirements, design, processes, etc., with the goal of producing a robust, low- 
cost, flexible, high-reliability product. The process focuses on reduction of criteria and specs, 
emphasizing variation reduction about the nominal instead of determining acceptable limits 
(fig. 88 and 89). It deals with the total (quality) cost function emphasizing the quality lever 
concepts which focuses up-front funding increases to get the right requirements and design 
which reduces later costs of manufacturing, production, and operations. This translates into 
fine turning the system without more total money. There is no more money. It recognizes the 
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principle that “you must lose to gain;’’ all improvements cost. It means something must be 
given up to improve. Giving up hurts. We resist hurt. Hard decisions must be made in terms 
of stringent priorities. If we are willing to pay the cost, TQM offers a breath of fresh air to the 
solution of our problems, providing a system with many new or innovative tools for 
accomplishing the various parts of the process. In fact, many confuse the use of such tools 
with TQM itself. Philosophy, principles, and tools must be adequately differentiated for 
progress. 

Fundamentally TQM is an attitude, an attitude which permeates top management and 
flows through the entire organization, that says that we can do better and will do better by 
emphasizing the customer's needs and relying on the people to do the job. Improvement must 
be continuous; it has many dimensions: 

- Reliability 

- Maintainability 

- Performance 

- Durability 

- Conformance (to requirements) 

- People 

- Policy 

- Management. 

It emphasizes team play. As Deming , 21 the American who was responsible for 
transforming Japan, says repeatedly, “The orchestra, not the soloist, is the approach.” 
Underlying this is the attitude or belief in the goodness of human nature. Most people want to 
do a good job, and will if the system will let them. To improve the product, the system has to 
be changed. This is accomplished in three ways. First, the customer, his needs, and 
requirements are focused upon. These translate into a product of high quality and low cost. 
Second, emphasis is placed on the people that do the job. They must be given the necessary 
authority and be trained “totally” as well as in skills (Deming’s principles ). 6-9 13 14 Anyone 
who has attended Deming’s course remembers: “Does he know? How could he know? He is 
only doing his best.” This is repeated many times to emphasize the point that “Missing 
knowledge is the rest of the problem.” People want to do a good job, the system does not 
permit it. Third, understand the process, change it where needed, observe the effects of 
change, then repeat. It is to plan, to check, to advise, and to repeat the cycle. Just as 
important is a constancy of purpose that is identifiable, communicable, and implementable by 
all people in the organization toward product improvement. This essentially places the blame 
or responsibility for quality on the system, and only management can change the system. 

The emphasis on process and management implies that you can only change 
something in a meaningful way if you understand it. To understand it you must be able to 
describe it in a simple way, flowing the total process from customer to product. Inherent in 
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this understanding is interpretation of data. Deming emphasizes over and over again that you 
cannot properly deal with data without knowledge. You can only get knowledge if there is a 
theory undergirding it as a basis to interpret data. Most of the time this knowledge comes 
from the outside. You cannot generate knowledge, you can only generate heat (activity). If 
the system generates fear then you will get the wrong answer, therefore, you must eliminate 
fear. Emphasis must be placed on controlling variations instead of meeting specification or 
tolerance limits. This places the responsibility back on the worker, where it should be, and 
changes the whole attitude on how to approach a job. TQM is a continuous process, a culture, 
a philosophy, a new way of life. As you can see, some of Deming’ s 14 principles are derived 
from his emphasis on constancy of purpose, people, customer, and variance. The guiding 
principles for an organization derived from these 14 principles are: quality first, customer 
satisfaction, continuous improvement, management commitment, employee involvement. 

TQM utilizes numerous tools, and additional tool concepts are under development. 
They rely on statistics, teamwork, and people development (training and communication). Up 
front always is the customer, his desires, his requirements. These requirements must be 
translated into a product. Quality function deployment (QFD) is one tool available for 
translating the customer’s needs into the manufactured product through a structured format of 
sequential matrices. Parallel to this must be the application of the tool simultaneous 
engineering (SE) (a take-off on systems engineering), that addresses concurrently, early in 
the design stage, performance characteristics, production process factors, and operational 
issues. Implied as mandatory is the use of teams with all pertinent disciplines represented, 
interaction, and open communication. QFD and SE are strongly cross-linked. Parameter 
design is the technique of establishing the optimum parameter levels of a system. The drastic 
change that inherently resists variation results in the best design. Taguchi, 36 a leading 
quality expert from Japan, actually deals with design in three steps: (1) system design based 
on experience and knowledge from specialized fields, (2) parameter design, and (3) tolerance 
design, i.e., the adjustment of tolerances of the input parameters to get the desired output. 
Analysis of variation (ANOVA) is a tool that allows you to judge what degree of 
sophistication is required to reap the rewards of experimental design. A mathematical tool for 
accomplishing this is signal-to-noise (S/N) ratio. The object is to increase the S/N ratio. 

Implementation of TQM is not easy. There are many deterrents which must be 
understood if progress is to be made. First and foremost, it requires a cultural change. 
Changes in cultures are resisted. We do not want to move from a known, where we are 
comfortable, to an unknown. There is always risk (perceived and actual) inherent in change. 
Change means acting on priorities, making decisions to give up something desirable for an 
unknown presumed to be more desirable. No one likes the loss required to gain (basic 
principle). A further problem exists because the employee has a problem in his/her ability to 
identify the difference between the quality of a product that meets limit specifications versus 
a product produced under a variation reduction approach. On the surface, limit specifications 
define acceptability, but the issue of quality is much deeper, which variation reduction 
addresses. An additional implementation problem occurs because, in general, we are doing a 
good job. All major sensitivities and contributors have been controlled to achieve top quality. 
What is left is fine tuning, dealing with small effects that, when combined with other small 
effects, produce lower quality. “How are we going to overcome these impediments?” is the 
major question we must deal with if we are going to implement TQM. The elements start 
with constant management focus, training in skills and of the whole person, teaming, and the 
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development of a new culture that properly considers the customer, the total cost, and the 
integrity of all workers. It requires in-depth understanding of the total process, formulation of 
hard questions relative to what and why we are doing this a certain way, priority decision to 
change that which is not needed, and the ability to communicate our purpose. 

In summary, TQM is a process that pays the greatest dividends by involving the 
customer, leverage dollars, and up-front efforts to achieve high-quality, lower-cost products 
through a multidiscipline team approach. If constraints or other considerations preclude the 
up-front high-leverage payoff, it still has merit when applied to a single process (loads 
analysis, CFD, testing, etc.) that one has under his control. The payoff is not nearly as high 
but is well worth the effort. The bottom line is: start wherever you are and improve the 
process. The attitude is contagious and with time will spread. Let it start with you. 
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Information in pitch comes from all contractors and NASA centers. Lessons learned are mine based on activities and 
discussions. 


- Centers 

JSC, KSC, MSFC, GSFC, LeRC, Stennis Space Center 

- Contractors 


Rockwell Space Division 

Rockwell Rocketdyne Division 

Morton Thiokol 

Martin 

TRW 

United Booster Technologies 

Perkin-Elmer 

Lockheed 

Pratt & Whitney 

Europeans 

Boeing 

Universities 

McDonnell Douglas 

Chrysler 


Shuttle Systems/Orbiter, Apollo 
Shuttle Main Engine 
Solid Rocket Motors 

External Tank, Tethered Satellite, TOS, Skylab 

HEAO, GMV, AXAF 

Solid Rocket Booster 

HST, AXAF 

HST 

ATD 

Spacelab, Tethered Satellite, HST 

Space Station, Saturn 

Experiments 

Saturn, Spacelab 

Saturn 


MSFC has worked in team mode on problems with contractors. Hard to differentiate contributions, although major 
source of technical data was the contractors. 


Contractors’ efforts, working relations, and technical expertise over the years is greatly appreciated and coveted as we 
move forward. 


Figure 1. Information source. 



Three Perspectives 

A. 51 -L Challenger accident investigation 


B. Shuttle safe return to flight activities 

- NRC (National Research Council) 

- Audits: FMEA/CIL, Weld Assessment (SSME), Structural Audit 
(SSME, ET), Fracture Mechanics (ET) 

- Redesign: SRM, SRB Aft Skirt 

- Shuttle Systems Environment Recertification 


C. 35 years engineering experience, mostly 
with NASA 

- Have synopsized by projects and problem causes 
approximately 1 50 problems 

Findings 

Failures, problems, in general, were not due to undiscovered or missing 
theory, but to the neglect or oversight of basic principles: 

- Management 

- Criteria 

- Procedures 

- Philosophy 
-Test 
-Analysis 

- Communication/Documentation 

- Project 


Figure 2. Perspectives and findings. 
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Problems Experienced and Envisioned 

Lessons Learned 

Purpose: Using problems experienced, develop lessons learned, and a context within which to 

design new systems through short summary documentation 

Approach: - Develop a matrix of problems experienced by project and discipline 

Projects 

1 . Apollo 

2. Skylab 

3. Viking 

4. Jupiter 

5. Redstone 

6. Shuttle 

A. System 

B. External Tank 

C. Solid Rocket Booster 

D. Space Shuttle Main Engine 

7. Hubble Space Telescope 

8. Gravity Probe B 

9. HE AO 

10. IPS 

- NDE 

9. Special Cases 

10. Development and Validation Testing (Improper) 

1 1 . Material Characterization 

-Approximately 100 problems categorized and documented; 50+ awaiting documentation 

- Document a summary with pertinent data for each problem 

- Develop lessons learned 

- Project potential problems for future space endeavors 

Figure 3. Lessons learned. 


1. Instabilities 

2. Forced Response 

- Static 

- Dynamic 

A. Environment 

B. Response 

- Static 

- Dynamic 

3. Modeling 

4. Acoustical Tuning 

5. Modal Tuning 

6. Manufacturing/Quality 

7. Fatigue (LCF & HCF) 

8. Fracture Control 

- Fracture Mechanics 



• Introduction 


• System focus, underlying perspective 

Requirements 

Trades Shuttle example 

Constraints 

• Basic principles 

• Specific examples to illustrate 

- Performance requirements 

- Models and test are limited 

- Bracketing hand analysis 

• Problems experienced 

- Sampling of problems by project 

• Lessons learned 

• Design guidelines 

• Envisioned tasks 

• References 


Figure 4. Agenda. 



Philosophy: Systems engineering/integration is the foundation. 


All engineering must be seen and implemented using a system 
focus. The parts are seen as interacting to form the whole. The 
whole is seen as the sum of its parts performing their function. 


This is the foundation for all major principles of design. 


Figure 5. Philosophy. 



• Subsystem optimization is costly. 

• Constraints can undermine design. 

• All disciplines must interact, even for subsystems. 

• Total cost is the criteria. 

• Systems optimization/requirements is the approach. 

• What is neglected in design (suboptimized) must be accounted for by 
good system optimization during operations (pay me now or pay me 
later). 
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Figure 6. System focus. 
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Figure 7. Design and verification A. 
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Figure 8. Design and verification B. 










Project 

• Goal 

• Objectives 


Vehicle Systems 


Propulsion 

•Solid 

• Liquid 

• Electric 

• Nuclear 


Avionics 

• Sensors 

• Software 

• Hardware 

• Actuators 

• Power 

• Communi- 
cations 

•Guidance 

• Control 


Structures 

• Composite 

• Me tali cs 

• Dynamics 

• Fractures 

• Stress 

• Thermal 


Design 

• Mainline 
•Comp- 

nents 

• Assembly 

• Manufac- 
ture/Con- 
struction 


Operations 

• Require- 
ments 

• Con- 
straints 

• Proce- 
dures 

• Robotics 

• Assembly 


SS 
Water 
•Air 

► Waste 

• Bacterial 

• Food 

► Thermal 


Materials 

Manufac- 

turing 

• Compos- 
ites 

• Metalics 

• Coatings 
•TPS 
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ization 



Aerobrake 

•TPS 

• Control 

• Environ- 
ments 

• Structure 

• Assembly 


• Technology Development • Procedures 

Integration 

• Test •Simulation 

• ICD’s & End Item Specs 

• Trade Studies • Guidelines 

• Hardware 

• Optimization 

• Verification Plans/Complete 

• Analysis 

• FEMA/CIL 

• Criteria 

• Cost 


Mini Iteration Loop 


Note: Each subsystem (example, 
propulsion) has the same 
inner loops as illustrated for 
the vehicle. 
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Figure 9. System design. 
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Figure 10. Quality lever. 
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Figure 12. Saturn IB. 
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A 

Vehicle 


B 

Vehicle 

No. 


Saturn IB SA-206 


Saturn IB I SA^207 


Saturn IB SA-208 


S-1B 

S-1BI.S. 

S-IVB 

I.U. 

S.C. WET 
LO Total 

S-1B 

S-1BI.S. 

S-IVB 

I.U. 

S.C. WET 
LO Total 

S-1B 

S-1BI.S. 

S-IVB 

I.U. 

S.C. WET 
LO Total 


EO denotes Earth Orbit 
ESC denotes Escape 
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Figure 14. Saturn V. 
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Figure 15. Saturn 1, IB, and Saturn V 
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Figure 19. S-II stage. 
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Figure 20. S-1C stage. 
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dC„ /d ( X/D) 



Normal Flow Distribution for Saturn V 


Figure 21. S-V aero distribution. 
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Normal Force Distribution for Saturn V Sky lab 
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Figure 22. S-V Skylab aero distribution. 
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PAROBABILITY OF NOT EXCEEDING (%) 


Maximum bending moment at vehicle station 80 m versus probability of 
not exceeding for March sample jimsphere winds 

Figure 24. Skylab maximum bending moment versus probability. 


U\ 

<1 




58 


Figure 25. HST SSM. 
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Figure 26. OTA with mirrors, 
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Figure 29. Space shuttle weights. 
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Figure 30b. Typical ascent and descent trajectory profiles. 











Pre-Lift-off Energy Storage 
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SHUTTLE LIFT-OFF LOADS COMPLEXITY 
BASE BENDING MOMENT AND SEQUENCING 



SEQUENCING 


\ 



T s MEC 



• SSME THRUST 90% ON ALL ENGINES - SRB IGNITION TIME BASE 

• LAGS UNTIL SRB IGNITION 

CHECKS IN SYSTEM 
DELIBERATE OR PLANNED DELAYS 


Figure 33. Shuttle liftoff sequence. 



Space Shuttle Lift-off Transient 



Figure 34a. Shuttle liftoff strut load response. 
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ET & SRB STRUT P10 (K-LB-F) 


LIMIT DESIGN LOADS: + 230 KLB 

- 258 KLB 



ANALYTIC AND FLIGHT-MEASURED ATTACH LOADS FOR 

STS-5 LIFTOFF 


Figure 34b. Shuttle liftoff strut load response. 
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Abort 
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Shortest Abort Mode Duration 

Relative Duration and Order of Preference for Abort Modes 


(Contingency Abort ) 


Figure 35. Shuttle abort modes. 
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Figure 37. Shuttle trajectory and control concepts. 
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Vertical Orientation 

Lateral Acceleration at Liftoff 
if Engines Gimabled to Give 
Minimum Rotational Transient 

or Rotational Transient if Engines 
Not Gimabled 



Non Symmetric Support and 
Holddown Forces 


Common Problems 

Static Bending Due to Weight 
and Wind at Release Leading 
to “Twang” 

Complicated Geometry to Track- 
Such as Wing Tip Below Pedestal 

Holddown Orientation with Respect 
to Prevailing Winds 

Large Aerodynamic Lifting 
Surfaces 


Tilted Orientation 


More Vertical Liftoff 



More Complicated Holddown 

Possibly More Complicated 
Reference Alignment and 
Control Axis Reference 

Possible Fuel Fill Problems 


-0 


Figure 39. Shuttle liftoff considerations. 
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Pre: 

Manned vs. Unmanned 

Initial: 

65 k Payload, Maximum 60 ft Length xl 5 ft Diameter 
Flyback Booster 

600 k to 700 k Liquid Engine (Booster and Orbiter) 

Orbiter Ferrying Capability 
$14B Cost 

All-Weather Auto Land, etc. 

Cross-Range 

Mid: 

Constraint on Cost 

Elimination of Flyback Booster, Orbiter Ferrying 

- Pressure Fed 

- Liquid 
-Solid 

Selection: 

1 1/2 Stage Parallel Burn Solid Boosters 

Water-Recoverable Boosters 

65 k Payload, 60 ft Length xl 5 ft Diameter (Maximum) 

SSME Thrust 470,000 VAC, ISP 453 (High Efficiency, Low Weight, High Technology) 
Passive Orbiter Heat Protection Tiles (High Technology) 

Modified Delta Wing 
Expendable Propulsion Tanks (ET) 


Figure 41a. Shuttle evolution. 



Constraints: 


150 klb Orbiter 
$5.5B Cost 

Dynamic Pressure (“Q") 
Max “G” 

Abort 

ET Disposal 


Reentry Designs Orbiter 
SRB Water Recovery 
Expendable External Tank 
Reduced Analysis and Test 
Volumetric/Weight of Engine 
Performance Reserve Allocation 


Constraints impact: 

Orbiter Could Not Meet 1 50 k (1 65 k) -► 1 80 k -► 1 90 k Inert 

104% and 109% SSME (Operational) 

Lightweight Tank 

Lightweight Higher Performance Solid 

Overpressure 
Water Suppression 
High Acoustics 
Payload at Noise Source 

Unsymmetrical Multibody Nonvertical Lift-Off; Stored Energy Release 
Strongly Coupled Ascent 

Operational Impacts: 

Dynamic Pressure 
Loads 

Ice (Damage to Tiles) 

Performance (Payload to Orbit) 

Temperature 

Weather 

Launch Probability 
Additional Analysis, etc. 

Figure 41b. Shuttle evolution. 



Sensitive or Marginal System 

SSME Lifetime (Refurbishment and Maintenance) (Process Control and Inspections) 
Orbiter Tiles (Debris Damage) (Refurbishment) 

Extensive Redesign 

Specific Mission Trajectory Shaping 

Detailed Launch Simulation Go - No Go 

Costly Operations Including Launch Holds 

Marginal SRB Skirt (Flight Instrumentation, Puck Biasing, Inspection) 

SRB/SRM Refurbishment 

Under Consideration: 

ASRM with 12,000 lb Performance Improvement 
Engine Upgrades 

-Two-Duct Hot Gas Manifold 

- Large MCC Throat 

- MCC Casting 
-Weld Eliminations 
-Alternate Turbopumps 


<1 


Figure 41c. Shuttle evolution. 
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OUTER FIBER CIR. STRESS (KSI) 


POST 7 & 8 EFFECT OF RADIAL LOAD POST 8 



□ 50% RADIAL + 100% RADIAL H 50% RADIAL 

Figure 43. Aft skirt radial load sensitivity. 
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PNbYb 4 . b 
FEB 15 1988 
12:05:58 
PLOT MO. 2 
POST 1 STRESS 
STEP =20 
ITER= 1 00 
EPQ i AVG '• 


XV = - 1 
YV = . 5 
ZV = -'l 
DIST= 10. 3 
XF =-58.8 
YF -86 . 4 
ZF = 83.9 
HIDDEN . 


MX = . 00944 
FIN = 0 

BH . 00197 
Hi .00307 
.00417 
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Figure 46. SRB skirt stress distribution along skin surface. 



SRB 3D SOLID ELEMENT/1 D1A 



Figure 47. SRM o-ring/segment joint. 


GTH MODEL 


PLANE STRAIN 
THIN WALL 


A= red 



DIM (INCHES) 

a * 28.95 — 31.9 
b = 72.5 
c - 73.05 

PROPERTIES 

E c = 30 x 10 6 PSI, v c = .3 
Ep = 600-900 PSI, v p = .499 
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O-RING GROOVE TOLERANCE EFFECTS 



MAXIMUM O-RING (DIA.285) 
MINIMUM GROOVE SIZE 


oo 


Figure 49. O-ring groove tolerance effects. 





TOTAL GAP OPENING (MILS) 



SRM TIME SCALE 


oo 
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Figure 51. Shuttle liftoff transient. 
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Figure 52. Liftoff sequence of events. 






- 6.5 - 6.0 - 5.5 - 5.0 - 4.5 - 4.0 - 3.5 - 3.0 - 2.5 - 2.0 - 1.5 - 1.0 - 0.5 0.0 0.5 1.0 1.5 2.0 2.5 3.0 


TIME (s) FROM 273/15/37/0.000 




STS-26 ANALYTIC AND TEST DATA FOR P9 FROM GAUGE 

B08G8198A 

Figure 53. Analytical to flight strut load compressions. 
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STS-26 ANALYTIC AND TEST DATA FOR P10 FROM GAUGE 

B08G8196A 
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STS-26 ANALYTIC AND TEST DATA FOR P12 FROM GAUGE 

B08G7198A 

Figure 56. Analytical to flight strut load compressions. 
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STS-26 ANALYTIC AND TEST DATA FOR P13 FROM GAUGE 

B08G7I96A 

Figure 57. Analytical to flight strut load compressions. 




STRUCTURAL EFFECTS/FINDINGS 


• PRIMARY PARAMETER DETERMINING FIELD JOINT GAP OPENING IS RADIAL PRESSURE 


•MOMENT 

• SHEAR 

• STRUT LOADS 

• RADIAL 

• LINE (PRESS/THRUST/ACC'L) 


7% 

1 % 

7% AFT FIELD JOINT LIFTOFF 
65% 

20 % 


• EXTERNAL LOADS AND DYNAMICS HAVE A SMALL EFFECT ON SEAL GAP OPENING 

• THE FORWARD FIELD JOINT HAS THE HIGHEST LOAD AND SEAL GAP OPENING 
(8 MILS MORE THAN AFT FIELD JOINT) 


• GAP PEAKS AT LIFTOFF THEN DECREASED DURING MAX "Q" TO APPROXIMATELY 
80% OF LIFTOFF VALUE - MAJOR GAP OPENING OCCURS WITHIN 600 MILS OF 
IGNITION. 


• THERE IS A VEHICLE STRUCTURAL DYNAMIC OSCILLATION DURING THE LIFTOFF 
TRANSIENT OF APPROXIMATELY 3 HZ. THE OSCILLATION ADDS ± 2 MILS TO THE 
SEAL GAP OPENING. 


Figure 58. Structural effects findings. 



M = MEASURED LOAD 
R = RECONSTRUCTED (ANALYSIS) LOAD 

STRUT LOAD 



LIMIT DESIGN LOADS: + 230 KLB 

• 258 KLB 


COMPARISON OF MEASURED VS RECONSTRUCTED FLIGHT 
LOADS P10 STRUT - STS-3 FLIGHT 


VO 
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Figure 59a. Max “q” strut load reconstitution. 




M * MEASURED LOAD 
R = RECONSTRUCTED (ANALYSIS) LOAD 


STRUT LOAD 
(LB) 

100000 



TIME (SECONDS) 


LIMIT DESIGN LOADS: + 230 KLB 

- 258 KLB 


COMPARISON OF MEASURED VS RECONSTRUCTED FLIGHT . 
LOADS P13 STRUT - STS-3 FLIGHT 


Figure 59b. Max “q” strut load reconstitution. 


Static Moment Balance of Misalignments at Lift-off 

Orbiter Control Only 
Solids Canted 15 in Yaw 


Solid Misalignments in Roll* 

= .3535 /Solid 

2 

Solid Misalignment in Yaw* 

=.3535 /Solid 

Solid Thrust Differential 

4 - 2 ^ = 2.96%/Solid 
2 

Lateral CG Variation (.0508 m) 
RSS Total 
* Mutually Exclusive 


Trim 

deg 


^ Trim 
deg 

5.87 


5MAX ^im 


deg 

5.87 


.62** 2.6 


3.2 


.29* 


1.2 


1.49 


.62 


2.6 


3.2 

8.47 


VO 

VO 


**8p Required to Cancel Roll Moment Due to 1 5y = 4.18 

Figure 60. SRM thrust vector misalignment effects. 
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Figure 6L Ascent parameters, 




Original Design Achieved Optimum Bajance 
(Performance, Loads, Launch Probability) 
at a\/EH ~ _2 ° 


General Features of Wing Load are: 



• If a VEH Shifts More Negative: 

Leading Edge Loads Increase 

• External Tank Loads Increase (Protuberances) 

• Wing Body Loads Decrease 

• Trajectory Tends to Loft (Performance Loss) 


Figure 62. Loads and performance relationship. 









Figure 65. Shuttle acoustic at 6.4 percent and overpressure hot fire model. 
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Figure 66. Overpressure suppression mods. 
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ONE-THIRD OCTAVE BAND SOUND PRESSURE LEVEL. dB 
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Acoustic levels with and without suppression 


Figure 69. Overall sound pressure levels with and without suppression 





Pre STS-26 Containment System 


Detonator/Booster (PYRO) 
Frangible Nut 


Holddown Stud 



Holddown Post 


SRB/MLP 

Interface 


Holddown Post 
Shoe 


Figure 70. SRB holddown bolt configuration. 



Hung-Up Bolt 

• Specific cause unknown 

• Possible caused by skewed 
PYRO firing 

• Two bolts hung-up on STS-2 

• One bolt hung-up on STS-4, 
STS-51 1, STS-61A, STS-34 and 
STS-33 

Non-Fracture of Frangible Nut 

• Dual failure 

• Low pribability of occurrence 



Holddown 

Stud 


Debris Catcher 
Detonator (NSI) (2) 

Frangible 

Nut 


MLP Support 
Post 


Shims 


Figure 71. Debris containment system. 
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Old Design 

STS-26, 27, 29, 30 


New Design 

STS-28, 34, 33 



Old 


Property 

A -286 

UTS (KSI) 

140.0 

YTS (KSI) 

95.0 

Elong (%) 

12.0 

Toughness 

14.1 


New 


Annealed MP35N 

132.0 

53.0 

68.0 
62.9 


Figure 72. Attach link material changes after STS-30. 






CONTROL CONFIDENCE 



CALENDAR YEARS 


A B C 

ET/SRB ET/SRB/DO ET/SRB/DO 

HVGVT (2) ET/DO ET/DO 

SEN. STUDY HVGVT (2) ET/SRB/101 ORB (1 COND.) 

SEN. STUDY SEN. STUDY 

Confidence factor versus test combination (control). 


Figure 73. Dynamic test option risks. 
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Design Constraints 
q ex = +4,000 — 3,000 
q J3 = ± 3,600 


Load Relief 

Fast Rotation in to Wind 
to Reduce q a and q (3 






Large Lead In 
Sensing Wind 


Increased Sensitivity to Elastic 
Body Stability and Response 
Reduced Stability Margins 
Increased Gust Loads 
Requires 

Complex Controls VS Beefup VS 
FPR Loss 




High Gain 
Accelerometer 
Feedback 


Control 


Signal 

Control 



System 





+ ~ = 


Vy \j Wind 


Figure 74. Control system complexity versus dynamic test. 


Rate Gyro 
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1 . Performance Requirements Drive Design. 

2. Philosophy Sets the Course and is Fundamental to Approach. 

3. Interfaces are Compatible and Well Defined. 

4. Configuration Complexity Determines Penetration. 

5. The Sum of Parts is Not Equal to the Whole. (System) 

6. Statistical Significance Determines Design Adequacy. 

7. Design for Robustness, Growth, and Flexibility. 

8. People are the Prime Source. The Secret of an Organization (Quality) is the Development of People, All 
People, Not Only in Skills But Totally. 

9. Analysis and Test Are Limited. Bracketing Hand Analysis is Key to Understanding. 

10. All. Data Must be Characterized, Justified, and Understood: Environments, Materials, Propulsion, etc. 

11. Read and Understand What the Hardware is Telling You. It has the Real Message. 

12. Good Engineers Must Touch Hardware. It is Better if They Have Done Manufacturing, Run a Lathe, Built 
a Cabinet, Struck a Weld, Shot an Alignment, etc. 

13. Proper Relationship Between Project Management and Science and Engineering With Clearly Defined 
Roles and Mission Between Government and Contractor. 

14. Open Communications Mandatory for Quality. 

15 Criteria or Legal Requirements Must Be Simple, Concise, Direct, Providing Order to the Engineering 
Process; But Not Overpowering to Where it Stifles Creativity and Removes Responsibility. Aerospace 
Engineering Requires the Best Answer. 


Figure 75. Underlying design principles. 



Sensitivity 



Performance 




Figure 76. Sensitivity versus performance. 
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ASI INJECTOR/COMBUSTION 
CHAMBER 


INJECTOR BODY 



THRUST CONE 


OXIDIZER MANIFOLD 


FROM MAIN 
OXIDIZER VALVE 


FROM HOT-GAS j—K. 
MANIFOLD 

FROM HIGH 
COOLANT CIRCUIT 

COLD HYDROGEN 
CAVITY 


BAFFLE ELEMENTS 
(75) 


OXIDIZER 
POSTS (600) 


SECONDARY 

PLATE 


PRIMARY 

PLATE 

MAIN ELEMENTS 
(525) 


Figure 78a. SSME lox dome and splitter. 



Figure 78b. SSME lox dome and splitter. 









Figure 79. Spectrum of gimbal bearing acceleration. 



• Load Sensitivities 


• Aft Skirt 

• Payload Loads 

• Performance Loss 

• Debris 

• Pad and Tower Clearances 

• Overpressure 

• Acoustics (Payloads at Source) 


Figure 80. Liftoff problems. 



COMPONENT 

DIR 

MAXIMUM ACCELERATION (G’s) 
LIFT-OFF LOADS 

DESIGN 

VALUE 

P.L.C. 

I.L.C. 

C.D.R. 

PRIMARY 

X 

3.7 

3.1 

3.5 

4.5 

MIRROR 

Y 

2.4 

1.1 

1.2 

0.9 


Z 

3.7 

2.6 

2.0 

3.2 

SECONDARY 

X 

3.8 

3.1 

3.4 

4.5 

MIRROR 

Y 

3.5 

2.3 

2.6 

2.3 


Z 

6.7 

5.0 

3.3 

12.9 


P L.C. = PRELIMINARY LOAD CYCLE, USED 5.4 SHUTTLE DATA 

I L C = INTERMEDIATE LOAD CYCLE, USED 5.7 SHUTTLE DATA 

C D R = CRITICAL DESIGN REVIEW LOAD CYCLE, USED 5.8 SHUTTLE DATA 


Figure 81. Design values and analysis cycle values. 
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Figure 83. 







Constraints Imposed Early Create a Suboptimized System Which Transfers and Increases the Cost, etc., in 
Operations. 

Communication is Mandatory for Quality. 

Must Work as a Team Composed of all Areas. 

All Great People Make Company With Good People, Not Necessarily Agreeable People but Good People. 
Extreme Environment Variations (Cycles) Are Hard to Deal With in Long-Life Machines. 

System Analysis is the Key to Good Design. 

Sensitivities Must be Quantified and Understood. 

Dynamic Systems with Large Energy Sources are Very Susceptible to Problems. 

Elimination of Subsystem (Element) Testing and Analysis Leads to Trouble. 

Start All Complex Analysis with Basic Hand Estimation. 

Dynamic Tuning Should be Avoided. 

Never Neglect the Potential Coupling Between Structures, Acoustics, Flow, Control, etc. 

Models are Only as Good as the Assumptions Made and the Experimental Data Input. 

All Testing Must be Preceded by Pretest Analysis Giving Procedures and Instrumentation, Followed by Model 
Correlation and Updating. 


Figure 85a. Lessons learned. 



Very Accurate Definition of the System is Required if it Must Operate Near a Stability Boundary or Margin Limit. 

Know What is Critical to the System; Model, Analyze, and Test That Area Accurately. 

Adequate Instrumentation is Required on All Tests and Flights and is Mandatory for All Critical Areas During 
Development Flights. Instrumentation Should be a Part of the Design. 

Multi-Body Dynamic Systems with Low Damping are Susceptible to Problems. 

Phases A and B of a Program Must Uncover Critical Technologies and Develop Approaches and Capabilities for 
Their Solutions. 

Read the Hardware; it has the Answers. 

Use Non-Linear Margins, etc., Only as Last Resort. Avoid During Design. 

People Determine the Design, the Hardware. 

Requirements, Constraints, etc., Leveled Early, Determine the Basic Hardware. Changes Made Later Are Only 
Tuning of the Original. It Is Nearly Impossible to Start Over With a Clean Sheet of Paper. 


Figure 85b. Lessons learned. 



1. Design Hardware for Inspectability and Manufacturability. 

2. Eliminate Welds or Design Peak Stress in Parent Material Not Welds. 

3. Design and Manufacture in Quality. Inspect for Insurance. 

4. Eliminate Static and Dynamic 3-D Coupling Where Possible. 

5. When Possible, Design in the Linear Range. Achieve Robustness. Employ Nonlinearities 
as the Last Resort. 

6. Match Methodology to the Problem. 

7. Margins Must be Specified and Validated. 

8. Procedure/Criteria/Philosophy are the Backbone of Design. 

9. Design Against Deterministic Criteria. Invoke Probabilities to Determine Sensitivities and 
Reliability. 

10. Limitations of Analysis and Test Must be Well Understood and Documented. 

1 1 . Design Against Total Cost With System Optimization. 

1 2. Design for Flexibility. What is Not Put in the Design Must be Made Safe by Operational 
Constraints, Maintenance, etc. 

1 3. Institute Early Automated Data Basing. 

14. Design for Insensitivity to Environments (Natural, Induced, Corrosion, etc.) or Control 
Their Variation and Accurately Define. 

15. Hydrostatic Damping Bearings Have Promise for High-Performance Turbo Pumps. 

Figure 86. Design guidelines. 
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• Design for and Implement Fracture Control 

- Linear Elastic Fracture Mechanics 

- Plastic Fracture Mechanics 

- Materials Characterization 

- NDE 

• Interdisciplinary Analysis 

- Thermal/Structural 

- Fluid/Structural 

- Structural Control Interaction 
-Aero Tailoring 

-Etc. 

• System Focus/Total Cost 

• Nonlinear Analysis 

- Geometric 

- Materials 

• Combined Testing 

• Statistical/Reliability Applied Mechanics 

• Extend Technologies 

• Robustness/Sensitivities 

• Customer Interaction, Feedback for Requirements 
•TQM 


Figure 87. Envisioned tasks. 
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Figure 88. Distribution of color density in TV sets. 


Taguchi Interpretation 
of Loss 



Figure 89. Taguchi interpretation of loss. 
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